Mozilla Firefox and Thunderbird: Memory corruption in Layout component
Summary
A memory-handling flaw (incorrect boundary conditions, CWE-119) in the Layout component of Firefox, Firefox ESR and Thunderbird can be exploited to affect confidentiality and integrity. The CVSS vector is network-reachable without privileges, but requires user interaction, such as visiting a crafted web page or opening crafted content. The exact trigger is not described publicly.
Affected
- Mozilla Firefox before 158 and Firefox ESR before 115.43 and 153.5 (per the Mozilla advisory and Debian data: all earlier versions are affected)
- Mozilla Thunderbird before 158 and before 153.5
- Linux distribution packages: versions depend on the distribution; Ubuntu lists Thunderbird on 22.04 LTS as vulnerable and Firefox as not affected on 22.04, 24.04 and 26.04
Fixed in
- Firefox 158
- Firefox ESR 115.43
- Firefox ESR 153.5
- Thunderbird 158 and 153.5
- Debian firefox-esr 153.5.0esr-1~deb12u1 (Debian 12)
- Other distributions: unknown, check the vendor advisory
Workaround
None known. The update is the fix.
Exploitation
- No reports of in-the-wild exploitation found.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Firefox to 158 or Firefox ESR to 115.43 or 153.5, and Thunderbird to 158 or 153.5, or use the current Mozilla release.
- On Linux, install the distribution's own package versions and advisories.
- Check managed endpoints for old ESR 115 or 153 installations and Thunderbird builds before the fix, and verify the new versions.
- Treat this as a regular patch item with priority for internet-facing browsers and mail clients.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-108 www.mozilla.org
- Debian OSV record DEBIAN-CVE-2026-109753 osv.dev
- Ubuntu CVE tracker CVE-2026-109753 ubuntu.com
- AlmaLinux updates issue 4068 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:45.
Original description (NVD)
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2068441
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.