Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CVE-2026-117983: Firefox and Thunderbird could crash or be exploited
CVE-2026-117983 · published 8 days ago
Summary
The graphics component in Firefox, Firefox ESR, and Thunderbird on Debian has a flaw that can cause the program to stop working or allow an attacker to run malicious code. This issue is resolved in Firefox version 159 and later, Firefox ESR 153.6 and later, and Thunderbird version 159 and later. Upgrade your browsers and email client to these versions as soon as possible.
What to do
- Update debian firefox-esr to version 153.6.0esr-1~deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox | All versions |
| – | mozilla | thunderbird | All versions |
| Debian:12 | debian | firefox-esr | All versions |
| Debian:12 | debian | thunderbird | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
| Debian:13 | debian | firefox-esr |
< 153.6.0esr-1~deb13u1 Fix: upgrade to 153.6.0esr-1~deb13u1
|
Original advisory text
DEBIAN-CVE-2026-117983
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
- https://security-tracker.debian.org/tracker/CVE-2026-117983 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=2078904 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-118/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-120/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-121/ Third Party Advisory
- https://ubuntu.com/security/CVE-2026-117983 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-117983 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/#CVE-2026-117983 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/#CVE-2026-117983 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/#CVE-2026-117983 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-122/ Third Party Advisory
Timeline
Published27 Oct 2026
Updated28 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-117983 · NVD
CVE-2026-117983 · MITRE
DEBIAN-CVE-2026-117983 · OSV
UBUNTU-CVE-2026-117983 · OSV
Track software like this
Free during beta