{"id":"CVE-2026-124904","kind":"vulnerability","aliases":["CVE-2026-124904"],"related":[],"title":"Firefox: use-after-free in SVG component may let attackers run code","description":"Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160.","summary":"A use-after-free bug in the SVG rendering component of Firefox was fixed in Firefox 160. Use-after-free flaws can let a crafted page corrupt memory and may allow code execution, but the sources do not state the impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","other"],"not_affected_if":["firefox-160-or-later"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`; versions before `160` include this flaw.","fix":"- Firefox: `160`","status":"open","published_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","triaged_at":"2026-11-10T14:24:47+00:00","updated_at":"2026-11-10T14:24:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`","reach":"internet","title":"Firefox: use-after-free in SVG component may let attackers run code","impact":"high","summary":"A use-after-free bug in the SVG rendering component of Firefox was fixed in Firefox 160. Use-after-free flaws can let a crafted page corrupt memory and may allow code execution, but the sources do not state the impact.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"unknown; memory corruption in the browser could allow code execution","analyst_note":"Confirm the Mozilla security advisory for this CVE to see the impact and whether it was exploited.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`; versions before `160` include this flaw.","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help, then About Firefox, and let it install.","product_name":"","needs_analyst":true,"not_affected_if":["firefox-160-or-later"],"who_is_affected":"Anyone running Firefox older than version 160 who opens untrusted web pages or SVG images may be exposed. Systems that do not use Firefox, or that already run version 160 or later, are not affected. The sources do not say whether any special setting is required.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4451,"output_tokens":535,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124904':16A,19A '-2026':15A,18A '160':40B,80C 'allow':55B 'attack':11A 'browser':20B 'bug':28B 'code':13A,56B 'compon':8A,33B,73C 'corrupt':51B 'craft':49B 'cve':14A,17A 'desktop':21B 'execut':57B 'firefox':1A,22B,35B,39B,79C 'fix':37B,77C 'flaw':45B 'free':5A,27B,44B,69C 'impact':65B 'let':10A,47B 'may':9A,54B 'memori':52B 'page':50B 'render':32B 'run':12A 'sourc':60B 'state':63B 'svg':7A,31B,72C 'use':3A,25B,42B,67C 'use-after-fre':2A,24B,41B,66C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than version 160 who opens untrusted web pages or SVG images may be exposed. Systems that do not use Firefox, or that already run version 160 or later, are not affected. The sources do not say whether any special setting is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help, then About Firefox, and let it install.","pkeys":[],"ptokens":[],"labels":["browser","desktop","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124904':16A,19A '-2026':15A,18A 'attack':11A 'code':13A 'compon':8A 'cve':14A,17A 'firefox':1A 'free':5A 'let':10A 'may':9A 'run':12A 'svg':7A 'use':3A 'use-after-fre':2A","search_b":"'160':40B 'allow':55B 'browser':20B 'bug':28B 'code':56B 'compon':33B 'corrupt':51B 'craft':49B 'desktop':21B 'execut':57B 'firefox':22B,35B,39B 'fix':37B 'flaw':45B 'free':27B,44B 'impact':65B 'let':47B 'may':54B 'memori':52B 'page':50B 'render':32B 'sourc':60B 'state':63B 'svg':31B 'use':25B,42B 'use-after-fre':24B,41B","search_c":"'160':80C 'compon':73C 'firefox':79C 'fix':77C 'free':69C 'svg':72C 'use':67C 'use-after-fre':66C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124904","severity":null,"published_at":"2026-11-10T14:17:24+00:00","modified_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","fetched_at":"2026-11-10T14:22:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}