Mozilla Firefox and Thunderbird: Memory corruption in SVG component
Summary
Incorrect boundary conditions in the SVG rendering component of Mozilla Firefox, Firefox ESR and Thunderbird allow memory corruption. An attacker can exploit this by persuading a user to load a crafted web page or open crafted content, which may lead to high impact on confidentiality, integrity and availability according to the CVSS vector. The CVSS data and Deferred NVD status were taken from the input and were not independently verified.
Affected
- Firefox versions before 158
- Firefox ESR versions before 153.5
- Thunderbird versions before 158 and before 153.5
- Firefox ESR 115: Unknown.
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
- Debian: DSA 6560-1 and DLA 4836-1 (firefox-esr)
- Fedora 44: firefox and thunderbird updates
- AlmaLinux 9.2 (TuxCare): thunderbird 153.5.0-1.el9_2.alma.1.tuxcare.els1
Workaround
- None needed if patched.
- No documented interim mitigation for unpatched installations found. Unknown.
Exploitation
- No evidence of exploitation in the wild found. Not marked as known exploited by one threat-intelligence aggregator; CISA KEV not checked directly.
- No public proof of concept found.
- Mozilla rates this bug as moderate; CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the fixed versions on all workstations.
- Check managed fleets, including Firefox ESR deployments and Thunderbird on mail clients, for outdated versions.
- Verify whether ESR 115 is affected and update if necessary.
- Monitor vendor advisories and CISA KEV for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory mfsa2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory mfsa2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla Bugzilla 2072438 bugzilla.mozilla.org
- Ubuntu CVE-2026-109762 ubuntu.com
- OSV CLSA-2026-1792779937 (AlmaLinux) osv.dev
- SUSE CVE entry via Vulners vulners.com
- HKCERT Mozilla security bulletin www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:11.
Original description (NVD)
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.