{"id":"CVE-2026-124857","kind":"vulnerability","aliases":["CVE-2026-124857"],"related":[],"title":"Firefox: use-after-free in Canvas2D graphics can crash or run code","description":"Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's Canvas2D graphics component lets memory be reused after it is freed. The sources do not state what an attacker can do beyond that, so the impact is not confirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`, and compare it against the fixed releases.\n- Check ESR installs for `115.45` or `153.7`.","fix":"- Firefox `160`\n- Firefox ESR `115.45`\n- Firefox ESR `153.7`","status":"open","published_at":"2026-11-10T14:17:17+00:00","first_seen_at":"2026-11-10T14:22:13+00:00","triaged_at":"2026-11-10T14:26:41+00:00","updated_at":"2026-11-10T14:26:41+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:26:41Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox `160`\n- Firefox ESR `115.45`\n- Firefox ESR `153.7`","reach":"internet","title":"Firefox: use-after-free in Canvas2D graphics can crash or run code","impact":"high","summary":"A use-after-free bug in Firefox's Canvas2D graphics component lets memory be reused after it is freed. The sources do not state what an attacker can do beyond that, so the impact is not confirmed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browsers"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; memory corruption could allow code execution","analyst_note":"Check the NVD entry and Mozilla's security advisory for this CVE to confirm trigger conditions and whether it is exploitable from a web page.","how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`, and compare it against the fixed releases.\n- Check ESR installs for `115.45` or `153.7`.","plain_action":"Update Firefox to version 160, or to ESR 115.45 or 153.7 if you use the ESR channel: open the menu, choose Help, then About Firefox.","product_name":"","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running a Firefox release older than the fixed versions is exposed, since the flaw is in the browser's own graphics code. The sources do not say whether a web page alone can trigger it. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":4492,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124857':16A,19A '-2026':15A,18A '115.45':79C '153.7':83C '160':76C 'attack':50B 'beyond':53B 'browser':20B 'bug':28B 'canvas2d':7A,32B,68C 'code':13A 'compon':34B,69C 'confirm':60B 'crash':10A 'cve':14A,17A 'esr':78C,82C 'firefox':1A,21B,30B,75C,77C,81C 'fix':73C 'free':5A,27B,64C 'freed':42B 'graphic':8A,33B,67C 'impact':57B 'let':35B 'memori':36B 'reus':38B 'run':12A 'runtim':22B 'sourc':44B 'state':47B 'use':3A,25B,62C 'use-after-fre':2A,24B,61C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox release older than the fixed versions is exposed, since the flaw is in the browser's own graphics code. The sources do not say whether a web page alone can trigger it. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160, or to ESR 115.45 or 153.7 if you use the ESR channel: open the menu, choose Help, then About Firefox.","pkeys":[],"ptokens":[],"labels":["browsers","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124857':16A,19A '-2026':15A,18A 'canvas2d':7A 'code':13A 'crash':10A 'cve':14A,17A 'firefox':1A 'free':5A 'graphic':8A 'run':12A 'use':3A 'use-after-fre':2A","search_b":"'attack':50B 'beyond':53B 'browser':20B 'bug':28B 'canvas2d':32B 'compon':34B 'confirm':60B 'firefox':21B,30B 'free':27B 'freed':42B 'graphic':33B 'impact':57B 'let':35B 'memori':36B 'reus':38B 'runtim':22B 'sourc':44B 'state':47B 'use':25B 'use-after-fre':24B","search_c":"'115.45':79C '153.7':83C '160':76C 'canvas2d':68C 'compon':69C 'esr':78C,82C 'firefox':75C,77C,81C 'fix':73C 'free':64C 'graphic':67C 'use':62C 'use-after-fre':61C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124857","severity":null,"published_at":"2026-11-10T14:17:17+00:00","modified_at":"2026-11-10T14:17:17+00:00","first_seen_at":"2026-11-10T14:22:13+00:00","fetched_at":"2026-11-10T14:22:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}