{"id":"CVE-2026-117978","kind":"vulnerability","aliases":["CVE-2026-117978"],"related":[],"title":"Firefox: Graphics boundary error fixed in releases 159 and ESR 153.6","description":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox's Graphics component has an incorrect boundary condition, a memory-handling flaw that the sources do not describe in further detail. The fix ships in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6, and the sources do not state what an attacker can gain from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":[],"how_to_check":"- Run `firefox --version` or open Help > About Firefox and compare against `159`, `115.44` or `153.6` (ESR)\n- unknown","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`\n- unknown","status":"open","published_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:11+00:00","updated_at":"2026-10-27T14:35:11+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:35:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`\n- unknown","reach":"unknown","title":"Firefox: Graphics boundary error fixed in releases 159 and ESR 153.6","impact":"medium","summary":"Firefox's Graphics component has an incorrect boundary condition, a memory-handling flaw that the sources do not describe in further detail. The fix ships in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6, and the sources do not state what an attacker can gain from it.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Mozilla security advisory for CVE-2026-117978 for the bug class, trigger conditions and severity rating.","how_to_check":"- Run `firefox --version` or open Help > About Firefox and compare against `159`, `115.44` or `153.6` (ESR)\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions on desktop or managed endpoints. The sources do not say whether the flaw needs a specific page, feature or setting to trigger, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000584,"input_tokens":3252,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117978':14A,17A '-2026':13A,16A '115.44':53B,85C '153.6':11A,57B,89C '159':8A,50B,82C 'attack':66B 'boundari':3A,29B,70C 'browser':18B 'compon':25B,75C 'condit':30B,71C 'cve':12A,15A 'describ':41B 'desktop':19B 'detail':44B 'error':4A 'esr':10A,52B,56B,84C,88C 'firefox':1A,20B,22B,49B,51B,55B,81C,83C,87C 'fix':5A,46B,79C 'flaw':35B 'gain':68B 'graphic':2A,24B,74C 'handl':34B 'incorrect':28B,69C 'memori':33B 'memory-handl':32B 'releas':7A 'runtim':21B 'ship':47B 'sourc':38B,60B 'state':63B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions on desktop or managed endpoints. The sources do not say whether the flaw needs a specific page, feature or setting to trigger, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117978","severity":null,"published_at":"2026-10-27T14:16:55+00:00","modified_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}