Paper/Archive/CVE-2026-117980

CVE-2026-117980

Mozilla Firefox — Use-after-free in the Graphics component

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

31

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 7.8.078 × 201.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Affected

ProductAffectedFixed inSource

Firefoxsee advisory153.6CNA

Thunderbirdsee advisory153.6CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2078145 refmozilla.org/security/advisories/mfsa2026-118 refmozilla.org/security/advisories/mfsa2026-120 refmozilla.org/security/advisories/mfsa2026-121 refmozilla.org/security/advisories/mfsa2026-122