by Kastro
Paper/Archive/CVE-2026-100788

CVE-2026-100788

Mozilla Thunderbird — Invalid pointer in the JavaScript: WebAssembly component

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.7.357 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Affected

ProductAffectedFixed inSource
Thunderbirdsee advisory140.17CNA
Firefoxsee advisory140.17CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2072413refmozilla.org/security/advisories/mfsa2026-100refmozilla.org/security/advisories/mfsa2026-101refmozilla.org/security/advisories/mfsa2026-102refmozilla.org/security/advisories/mfsa2026-103refmozilla.org/security/advisories/mfsa2026-97refmozilla.org/security/advisories/mfsa2026-99