{"id":"CVE-2026-117980","kind":"vulnerability","aliases":["CVE-2026-117980"],"related":[],"title":"Firefox: use-after-free in Graphics component may allow code execution","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free bug in the Graphics component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker gains beyond that, so exploitation impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or ESR `153.6`\n- unknown","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:10+00:00","updated_at":"2026-10-27T14:35:10+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:35:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: use-after-free in Graphics component may allow code execution","impact":"medium","summary":"A use-after-free bug in the Graphics component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker gains beyond that, so exploitation impact is unconfirmed.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Mozilla security advisory for this Graphics use-after-free to confirm impact, trigger conditions and whether it is exploited.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or ESR `153.6`\n- unknown","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed releases is affected. The sources do not say which platforms or configurations are most exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000547,"input_tokens":3230,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117980':15A,18A '-2026':14A,17A '153.6':78C '159':74C 'allow':10A 'attack':51B 'beyond':53B 'browser':21B 'bug':29B 'code':11A 'compon':8A,33B,67C 'cve':13A,16A 'desktop':20B 'desktop-brows':19B 'esr':77C 'execut':12A 'exploit':56B 'firefox':1A,22B,35B,73C,76C 'fix':71C 'free':5A,28B,63C 'freed':43B 'gain':52B 'graphic':7A,32B,66C 'impact':57B 'let':36B 'may':9A 'memori':37B 'reus':39B 'runtim':23B 'sourc':45B 'state':48B 'unconfirm':59B 'use':3A,26B,61C 'use-after-fre':2A,25B,60C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed releases is affected. The sources do not say which platforms or configurations are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117980","severity":null,"published_at":"2026-10-27T14:16:55+00:00","modified_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}