{"id":"CVE-2026-117979","kind":"vulnerability","aliases":["CVE-2026-117979"],"related":[],"title":"Firefox: WebRender boundary check flaw fixed in recent releases","description":"Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Incorrect boundary conditions in Firefox's WebRender graphics component were fixed in Firefox 159 and ESR 115.44 and 153.6. The sources do not say what an attacker can do with it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["fixed-version"],"how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare with `159` or the ESR builds `115.44` and `153.6`\n- unknown","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, whichever branch is in use","status":"open","published_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:11+00:00","updated_at":"2026-10-27T14:35:11+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:35:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, whichever branch is in use","reach":"unknown","title":"Firefox: WebRender boundary check flaw fixed in recent releases","impact":"medium","summary":"Incorrect boundary conditions in Firefox's WebRender graphics component were fixed in Firefox 159 and ESR 115.44 and 153.6. The sources do not say what an attacker can do with it.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not describe the impact","analyst_note":"Check the Mozilla security advisory for this CVE to find the impact, trigger conditions and whether it is exploitable from web content.","how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare with `159` or the ESR builds `115.44` and `153.6`\n- unknown","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone running Firefox builds older than the fixed releases on desktop or in managed fleets. The sources do not say which platforms or configurations are exposed, and the description gives no trigger detail. Teams that run only the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00058,"input_tokens":3262,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117979':12A,15A '-2026':11A,14A '115.44':36B,64C '153.6':38B,68C '159':33B,61C 'attack':46B 'boundari':3A,21B,48C 'browser':16B 'check':4A 'compon':28B,54C 'condit':22B,49C 'cve':10A,13A 'desktop':17B 'esr':35B,63C,67C 'firefox':1A,18B,24B,32B,60C,62C,66C 'fix':6A,30B,58C 'flaw':5A 'graphic':27B,52C 'incorrect':20B,47C 'recent':8A 'releas':9A 'runtim':19B 'say':43B 'sourc':40B 'vulner':56C 'webrend':2A,26B,53C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than the fixed releases on desktop or in managed fleets. The sources do not say which platforms or configurations are exposed, and the description gives no trigger detail. Teams that run only the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117979","severity":null,"published_at":"2026-10-27T14:16:55+00:00","modified_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}