{"id":"CVE-2026-117996","kind":"vulnerability","aliases":["CVE-2026-117996"],"related":[],"title":"Firefox: WebRTC boundary-condition flaw fixed in Firefox 159","description":"Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"Firefox's WebRTC component mishandles boundary conditions, a memory-safety class of bug. The sources do not say what an attacker gets beyond that, so impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","firefox-esr","runtime","webrtc"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed Firefox version with `about:support` or the Help menu\n- Compare against the fixed release: Firefox `159` or Firefox ESR `153.6`\n- Confirm whether the affected WebRTC feature is in use","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:34:55+00:00","updated_at":"2026-10-27T14:34:55+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:34:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: WebRTC boundary-condition flaw fixed in Firefox 159","impact":"medium","summary":"Firefox's WebRTC component mishandles boundary conditions, a memory-safety class of bug. The sources do not say what an attacker gets beyond that, so impact is unconfirmed.","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","browsers","webrtc"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not state what an attacker gets","analyst_note":"Check the Mozilla security advisory for the fixed Firefox 159 and ESR 153.6 releases to confirm the impact, trigger conditions and whether the bug is memory corruption.","how_to_check":"- Check the installed Firefox version with `about:support` or the Help menu\n- Compare against the fixed release: Firefox `159` or Firefox ESR `153.6`\n- Confirm whether the affected WebRTC feature is in use","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Users of Firefox builds older than version 159 and Firefox ESR builds older than 153.6 are likely exposed, since WebRTC is enabled by default in Firefox. The sources do not say whether specific configurations or sites are required to trigger it. Teams that manage Firefox through a fixed, pinned ESR build should check whether they are on an unpatched point release.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":3242,"output_tokens":592,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117996':13A,16A '-2026':12A,15A '153.6':70C '159':10A,66C 'attack':45B 'beyond':47B 'boundari':4A,29B,54C 'boundary-condit':3A 'browser':17B 'bug':37B 'class':35B 'compon':27B,59C 'condit':5A,30B,55C 'cve':11A,14A 'esr':21B,69C 'firefox':1A,9A,18B,20B,24B,65C,68C 'firefox-esr':19B 'fix':7A,63C 'flaw':6A 'get':46B 'impact':50B 'incorrect':53C 'memori':33B 'memory-safeti':32B 'mishandl':28B 'runtim':22B 'safeti':34B 'say':42B 'sourc':39B 'unconfirm':52B 'vulner':61C 'webrtc':2A,23B,26B,58C","nicknames":[],"mitigations":[],"who_affected":"Users of Firefox builds older than version 159 and Firefox ESR builds older than 153.6 are likely exposed, since WebRTC is enabled by default in Firefox. The sources do not say whether specific configurations or sites are required to trigger it. Teams that manage Firefox through a fixed, pinned ESR build should check whether they are on an unpatched point release.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117996","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}