Description
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Published: 2026-09-29
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential for arbitrary code execution or crash
Action: Apply patch
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in the XSLT component. The CVE description is brief and does not specify exploitation details, but the flaw is listed as CWE‑416 issue that could allow memory corruption, potentially leading to a crash or other unintended behavior.

Affected Systems

Mozilla Firefox and Thunderbird are affected. The flaw was addressed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17; in Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. Installations running earlier releases are vulnerable.

Risk and Exploitability

The EPSS score is 0.00311 and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation activity. The CVSS score of 8.8 indicates high severity. The CVE description does not specify a particular attack vector; however, based on the nature of the vulnerability, a crafted XSLT document could trigger the bug when processed by the browser. Because the description does not mention a web context explicitly, the attack vector is indeterminate but could originate from any source that the browser loads XSLT content (e.g., a web page or an email attachment). Until a patched version is installed, the risk remains significant.

Generated by OpenCVE AI on October 1, 2026 at 01:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Firefox ESR 153.4, Firefox 157, ESR 115.42, or ESR 140.17 and restart the browser to apply the patch.
  • If an upgrade cannot be performed immediately, disable XSLT processing in the browser’s configuration if the option is available.
  • Monitor the browser for abnormal crashes or instability and enforce policies that block untrusted XSLT documents from being processed.

Generated by OpenCVE AI on October 1, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4810-1 thunderbird security update
Debian DLA Debian DLA DLA-4814-1 firefox-esr security update
Debian DSA Debian DSA DSA-6533-1 firefox-esr security update
Debian DSA Debian DSA DSA-6536-1 thunderbird security update
History

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References

Tue, 29 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Title Use-after-free in the XSLT component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-30T17:20:32.042Z

Reserved: 2026-09-26T19:17:18.478Z

Link: CVE-2026-100790

cve-icon Vulnrichment

Updated: 2026-09-29T14:40:26.200Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:44.030

Modified: 2026-10-19T16:27:17.473

Link: CVE-2026-100790

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T01:30:07Z

Weaknesses