{"id":"CVE-2026-117986","kind":"vulnerability","aliases":["CVE-2026-117986"],"related":[],"title":"Firefox: use-after-free in Graphics component may allow code execution","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free bug in Firefox's Graphics component was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gains beyond the memory corruption itself.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","firefox","firefox-esr","other"],"not_affected_if":["already-updated"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Check whether the installed version is below `159` for Firefox or below `153.6` for Firefox ESR","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:03+00:00","updated_at":"2026-10-27T14:35:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:35:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: use-after-free in Graphics component may allow code execution","impact":"high","summary":"A use-after-free bug in Firefox's Graphics component was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gains beyond the memory corruption itself.","category":"other","nicknames":[],"who_cares":["firefox","firefox-esr","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; use-after-free may allow memory corruption and code execution","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the trigger, the attacker outcome and the exact fixed versions.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Check whether the installed version is below `159` for Firefox or below `153.6` for Firefox ESR","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Teams that run Firefox or Firefox ESR on their own machines or managed desktops are affected until they update. The sources do not say which configurations or content types trigger the flaw, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3230,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117986':15A,18A '-2026':14A,17A '153.6':43B,75C '159':39B,71C 'allow':10A 'attack':51B 'beyond':53B 'bug':29B 'code':11A 'compon':8A,34B,64C 'corrupt':56B 'cve':13A,16A 'desktop':19B 'esr':23B,42B,74C 'execut':12A 'firefox':1A,20B,22B,31B,38B,41B,70C,73C 'firefox-esr':21B 'fix':36B,68C 'free':5A,28B,60C 'gain':52B 'graphic':7A,33B,63C 'may':9A 'memori':55B 'say':48B 'sourc':45B 'use':3A,26B,58C 'use-after-fre':2A,25B,57C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Firefox or Firefox ESR on their own machines or managed desktops are affected until they update. The sources do not say which configurations or content types trigger the flaw, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117986","severity":null,"published_at":"2026-10-27T14:16:56+00:00","modified_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}