{"id":"CVE-2026-124886","kind":"vulnerability","aliases":["CVE-2026-124886"],"related":[],"title":"Firefox: invalid pointer in text layout and font handling","description":"Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"Firefox's Layout: Text and Fonts component contains an invalid pointer flaw. The sources do not say what an attacker gets from it, and the description only states it was fixed in Firefox 160 and Firefox ESR 153.7.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","other"],"not_affected_if":["already-updated"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog.\n- Compare it against `160` (Firefox) and `153.7` (Firefox ESR).","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:21+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","triaged_at":"2026-11-10T14:26:07+00:00","updated_at":"2026-11-10T14:26:07+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:26:07Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"unknown","title":"Firefox: invalid pointer in text layout and font handling","impact":"medium","summary":"Firefox's Layout: Text and Fonts component contains an invalid pointer flaw. The sources do not say what an attacker gets from it, and the description only states it was fixed in Firefox 160 and Firefox ESR 153.7.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the impact, trigger and whether it is exploitable.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog.\n- Compare it against `160` (Firefox) and `153.7` (Firefox ESR).","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 (Help > About Firefox).","product_name":"","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions. The sources do not describe the trigger or the exposed configuration.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4482,"output_tokens":505,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124886':12A,15A '-2026':11A,14A '153.7':55B,75C '160':51B,71C 'attack':37B 'browser':16B 'compon':24B,64C 'contain':25B 'cve':10A,13A 'descript':43B 'esr':54B,74C 'firefox':1A,17B,18B,50B,53B,70C,73C 'fix':48B,68C 'flaw':29B 'font':8A,23B,63C 'get':38B 'handl':9A 'invalid':2A,27B,56C 'layout':6A,20B,60C 'pointer':3A,28B,57C 'say':34B 'sourc':31B 'state':45B 'text':5A,21B,61C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions. The sources do not describe the trigger or the exposed configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 (Help > About Firefox).","pkeys":[],"ptokens":[],"labels":["browser","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124886':12A,15A '-2026':11A,14A 'cve':10A,13A 'firefox':1A 'font':8A 'handl':9A 'invalid':2A 'layout':6A 'pointer':3A 'text':5A","search_b":"'153.7':55B '160':51B 'attack':37B 'browser':16B 'compon':24B 'contain':25B 'descript':43B 'esr':54B 'firefox':17B,18B,50B,53B 'fix':48B 'flaw':29B 'font':23B 'get':38B 'invalid':27B 'layout':20B 'pointer':28B 'say':34B 'sourc':31B 'state':45B 'text':21B","search_c":"'153.7':75C '160':71C 'compon':64C 'esr':74C 'firefox':70C,73C 'fix':68C 'font':63C 'invalid':56C 'layout':60C 'pointer':57C 'text':61C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124886","severity":null,"published_at":"2026-11-10T14:17:21+00:00","modified_at":"2026-11-10T14:17:21+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","fetched_at":"2026-11-10T14:22:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}