Paper/Archive/CVE-2026-113399

CVE-2026-113399

Mozilla Firefox — Incorrect boundary conditions in the SVG component

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

31

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 7.5.075 × 201.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

Affected

ProductAffectedFixed inSource

Firefoxsee advisory158.0.1CNA

Thunderbirdsee advisory158.0.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2079938 refmozilla.org/security/advisories/mfsa2026-111 refmozilla.org/security/advisories/mfsa2026-114