{"id":"CVE-2026-117956","kind":"vulnerability","aliases":["CVE-2026-117956"],"related":[],"title":"Firefox: invalid pointer in Nimbus Desktop Client component fixed","description":"Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"The Nimbus Desktop Client component in Firefox contains an invalid pointer bug. The sources do not say what an attacker gets beyond the memory corruption itself.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","firefox","other"],"not_affected_if":["updated-firefox"],"how_to_check":"- Run `firefox --version` and compare against `159` or `153.6` for ESR\n- unknown for any other check","fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown for any other action","status":"open","published_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:35:32+00:00","updated_at":"2026-10-27T14:35:32+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:35:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown for any other action","reach":"unknown","title":"Firefox: invalid pointer in Nimbus Desktop Client component fixed","impact":"medium","summary":"The Nimbus Desktop Client component in Firefox contains an invalid pointer bug. The sources do not say what an attacker gets beyond the memory corruption itself.","category":"other","nicknames":[],"who_cares":["firefox","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Check the Mozilla security advisory for the Firefox 159 / ESR 153.6 release to learn the trigger and impact of the Nimbus Desktop Client invalid pointer bug.","how_to_check":"- Run `firefox --version` and compare against `159` or `153.6` for ESR\n- unknown for any other check","needs_analyst":true,"not_affected_if":["updated-firefox"],"who_is_affected":"Teams that run or depend on desktop Firefox builds older than Firefox 159 or Firefox ESR 153.6 are affected. The sources do not say what configuration or data path makes a system exposed, so unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000566,"input_tokens":3246,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117956':12A,15A '-2026':11A,14A '153.6':61C '159':57C 'attack':37B 'beyond':39B 'bug':29B 'client':7A,21B,49C 'compon':8A,22B,50C 'contain':25B 'corrupt':42B 'cve':10A,13A 'desktop':6A,16B,20B,48C 'esr':60C 'firefox':1A,17B,24B,56C,59C 'fix':9A,54C 'get':38B 'invalid':2A,27B,43C 'memori':41B 'nimbus':5A,19B,47C 'pointer':3A,28B,44C 'say':34B 'sourc':31B 'vulner':52C","nicknames":[],"mitigations":[],"who_affected":"Teams that run or depend on desktop Firefox builds older than Firefox 159 or Firefox ESR 153.6 are affected. The sources do not say what configuration or data path makes a system exposed, so unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117956","severity":null,"published_at":"2026-10-27T14:16:51+00:00","modified_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}