{"id":"CVE-2026-117952","kind":"vulnerability","aliases":["CVE-2026-117952"],"related":[],"title":"Firefox: uninitialized memory in Networking component fixed in releases","description":"Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox's Networking component reads memory that was never initialized, which can leak data or cause unpredictable behavior. The sources do not say whether an attacker can reliably turn this into code execution or what data is exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","enterprise-endpoints","firefox","other"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against the fixed versions listed below.\n- Check ESR installs with `firefox --version` against `115.44` and `153.6`.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR 115 to `115.44` or later.\n- Update Firefox ESR 153 to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:35:36+00:00","updated_at":"2026-10-27T14:35:36+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:35:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR 115 to `115.44` or later.\n- Update Firefox ESR 153 to `153.6` or later.","reach":"unknown","title":"Firefox: uninitialized memory in Networking component fixed in releases","impact":"medium","summary":"Firefox's Networking component reads memory that was never initialized, which can leak data or cause unpredictable behavior. The sources do not say whether an attacker can reliably turn this into code execution or what data is exposed.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers","enterprise-endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory disclosure or crash from uninitialized data","analyst_note":"Check the Mozilla security advisory for this CVE for severity, trigger conditions and whether it allows code execution or only information disclosure.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against the fixed versions listed below.\n- Check ESR installs with `firefox --version` against `115.44` and `153.6`.","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or any platform that ships the affected Networking code. Managed fleets pinned to older ESR branches are the most likely to lag. The sources do not say whether any non-default configuration is needed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000608,"input_tokens":3244,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117952':12A,15A '-2026':11A,14A '115.44':76C '153.6':80C '159':73C 'attack':48B 'behavior':40B 'browser':18B 'caus':38B 'code':54B 'compon':6A,26B,66C 'cve':10A,13A 'data':36B,58B 'desktop':17B 'desktop-brows':16B 'endpoint':21B 'enterpris':20B 'enterprise-endpoint':19B 'esr':75C,79C 'execut':55B 'expos':60B 'firefox':1A,22B,23B,72C,74C,78C 'fix':7A,70C 'initi':32B 'leak':35B 'memori':3A,28B,62C 'network':5A,25B,65C 'never':31B 'read':27B 'releas':9A 'reliabl':50B 'say':45B 'sourc':42B 'turn':51B 'uniniti':2A,61C 'unpredict':39B 'vulner':68C 'whether':46B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or any platform that ships the affected Networking code. Managed fleets pinned to older ESR branches are the most likely to lag. The sources do not say whether any non-default configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117952","severity":null,"published_at":"2026-10-27T14:16:51+00:00","modified_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}