---
id: "CVE-2026-124857"
page: "https://infrastack.ai/live/CVE-2026-124857"
kind: "vulnerability"
aliases: ["CVE-2026-124857"]
title: "Firefox: use-after-free in Canvas2D graphics can crash or run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "firefox", "runtime"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-11-10T14:17:17+00:00"
first_seen_at: "2026-11-10T14:22:13+00:00"
updated_at: "2026-11-10T14:26:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124857", "first_seen_at": "2026-11-10T14:22:13+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in Canvas2D graphics can crash or run code

Link for people: https://infrastack.ai/live/CVE-2026-124857 (this .md is for agents)

A use-after-free bug in Firefox's Canvas2D graphics component lets memory be reused after it is freed. The sources do not state what an attacker can do beyond that, so the impact is not confirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Firefox version in the browser's About page or with `firefox --version`, and compare it against the fixed releases.
- Check ESR installs for `115.45` or `153.7`.

## Fix

- Firefox `160`
- Firefox ESR `115.45`
- Firefox ESR `153.7`

## Timeline

- 2026-11-10T14:22:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124857

## From the sources

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_