{"id":"CVE-2026-124879","kind":"vulnerability","aliases":["CVE-2026-124879"],"related":[],"title":"Firefox: invalid pointer in networking cache may let attackers crash or run code","description":"Invalid pointer in the Networking: Cache component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"An invalid pointer in Firefox's Networking Cache component was fixed in Firefox 160 and Firefox ESR 153.7. The sources do not state what an attacker can achieve beyond that memory-safety flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","firefox-esr","runtime"],"not_affected_if":["already-updated"],"how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version`.\n- Compare the result against `160` for Firefox and `153.7` for Firefox ESR.","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:20+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","triaged_at":"2026-11-10T14:26:14+00:00","updated_at":"2026-11-10T14:26:14+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:26:14Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"unknown","title":"Firefox: invalid pointer in networking cache may let attackers crash or run code","impact":"high","summary":"An invalid pointer in Firefox's Networking Cache component was fixed in Firefox 160 and Firefox ESR 153.7. The sources do not state what an attacker can achieve beyond that memory-safety flaw.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; invalid pointer flaw may allow memory corruption","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the attack vector and whether it is exploitable from web content.","how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version`.\n- Compare the result against `160` for Firefox and `153.7` for Firefox ESR.","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 through its built-in updater.","product_name":"","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions is exposed to this networking cache flaw. Systems on managed Firefox builds should follow their own update channel. The sources do not say whether the flaw is reachable from web content without user action.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4474,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124879':16A,19A '-2026':15A,18A '153.7':43B,77C '160':39B,73C 'achiev':53B 'attack':9A,51B 'beyond':54B 'browser':20B 'cach':6A,33B,65C 'code':13A 'compon':34B,66C 'crash':10A 'cve':14A,17A 'esr':24B,42B,76C 'firefox':1A,21B,23B,30B,38B,41B,72C,75C 'firefox-esr':22B 'fix':36B,70C 'flaw':59B 'invalid':2A,27B,60C 'let':8A 'may':7A 'memori':57B 'memory-safeti':56B 'network':5A,32B,64C 'pointer':3A,28B,61C 'run':12A 'runtim':25B 'safeti':58B 'sourc':45B 'state':48B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions is exposed to this networking cache flaw. Systems on managed Firefox builds should follow their own update channel. The sources do not say whether the flaw is reachable from web content without user action.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 through its built-in updater.","pkeys":[],"ptokens":[],"labels":["browser","firefox","firefoxesr","runtime","unknown"],"campaign_type":null,"search_a":"'-124879':16A,19A '-2026':15A,18A 'attack':9A 'cach':6A 'code':13A 'crash':10A 'cve':14A,17A 'firefox':1A 'invalid':2A 'let':8A 'may':7A 'network':5A 'pointer':3A 'run':12A","search_b":"'153.7':43B '160':39B 'achiev':53B 'attack':51B 'beyond':54B 'browser':20B 'cach':33B 'compon':34B 'esr':24B,42B 'firefox':21B,23B,30B,38B,41B 'firefox-esr':22B 'fix':36B 'flaw':59B 'invalid':27B 'memori':57B 'memory-safeti':56B 'network':32B 'pointer':28B 'runtim':25B 'safeti':58B 'sourc':45B 'state':48B","search_c":"'153.7':77C '160':73C 'cach':65C 'compon':66C 'esr':76C 'firefox':72C,75C 'fix':70C 'invalid':60C 'network':64C 'pointer':61C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124879","severity":null,"published_at":"2026-11-10T14:17:20+00:00","modified_at":"2026-11-10T14:17:20+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","fetched_at":"2026-11-10T14:22:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}