{"id":"CVE-2026-124932","kind":"vulnerability","aliases":["CVE-2026-124932"],"related":[],"title":"Firefox: use-after-free in Graphics component may allow code execution","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in the Graphics component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker can do with it beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","firefox","other"],"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"how_to_check":"- Run `about:support` in Firefox and compare the version with the fixed releases","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:27+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:17+00:00","updated_at":"2026-11-10T14:24:17+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:17Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"unknown","title":"Firefox: use-after-free in Graphics component may allow code execution","impact":"high","summary":"A use-after-free bug in the Graphics component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker can do with it beyond that.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; use-after-free bugs can allow memory corruption and code execution","analyst_note":"Confirm the trigger, attacker requirements and worst-case impact from the Mozilla advisory for this CVE; the NVD entry gives no detail.","how_to_check":"- Run `about:support` in Firefox and compare the version with the fixed releases\n- unknown","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 using its built-in update check.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"who_is_affected":"Anyone running a Firefox build older than 160 or Firefox ESR older than 153.7. The sources do not say what page or action triggers the flaw, so it is unknown whether browsing alone is enough.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000719,"input_tokens":4466,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124932':15A,18A '-2026':14A,17A '153.7':73C '160':69C 'allow':10A 'attack':49B 'beyond':54B 'browser':20B 'bug':27B 'code':11A 'compon':8A,31B,62C 'cve':13A,16A 'esr':72C 'execut':12A 'firefox':1A,19A,21B,33B,68C,71C 'fix':66C 'free':5A,26B,58C 'freed':41B 'graphic':7A,30B,61C 'let':34B 'may':9A 'memori':35B 'reus':37B 'sourc':43B 'state':46B 'use':3A,24B,56C 'use-after-fre':2A,23B,55C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than 160 or Firefox ESR older than 153.7. The sources do not say what page or action triggers the flaw, so it is unknown whether browsing alone is enough.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 using its built-in update check.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","firefox","other","unknown","vendor"],"campaign_type":null,"search_a":"'-124932':15A,18A '-2026':14A,17A 'allow':10A 'code':11A 'compon':8A 'cve':13A,16A 'execut':12A 'firefox':1A,19A 'free':5A 'graphic':7A 'may':9A 'use':3A 'use-after-fre':2A","search_b":"'attack':49B 'beyond':54B 'browser':20B 'bug':27B 'compon':31B 'firefox':21B,33B 'free':26B 'freed':41B 'graphic':30B 'let':34B 'memori':35B 'reus':37B 'sourc':43B 'state':46B 'use':24B 'use-after-fre':23B","search_c":"'153.7':73C '160':69C 'compon':62C 'esr':72C 'firefox':68C,71C 'fix':66C 'free':58C 'graphic':61C 'use':56C 'use-after-fre':55C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124932","severity":null,"published_at":"2026-11-10T14:17:27+00:00","modified_at":"2026-11-10T14:17:27+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}