Description
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Published: 2026-09-29
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential Remote Code Execution
Action: Patch
AI Analysis

Impact

The JIT miscompilation flaw in the JavaScript WebAssembly component can lead the JIT engine to generate incorrect machine instructions during the execution of WebAssembly modules. The advisory does not specify whether this miscompilation results in memory corruption or code execution, so the precise impact remains uncertain beyond the possibility of unintended code execution.

Affected Systems

Mozilla Firefox and Thunderbird are affected. Versions prior to Firefox ESR 153.4, Firefox 157, Firefox ESR 140.17, and Thunderbird releases before 140.17, 153.4, and 157 are vulnerable. All platforms running these older builds, wherever the browser processes WebAssembly, are potentially impacted.

Risk and Exploitability

The CVSS score of 7.1 reflects moderate‑to‑high severity, while the EPSS score of <1% indicates a low probability that the flaw will be actively exploited. The issue is classified as CWE‑843. Attackers would need to deliver malicious WebAssembly or JavaScript to the user, implying a web‑originated vector. The flaw is not listed in the CISA KEV catalog and no public proof‑of‑concept or documented real‑world exploitation is known.

Generated by OpenCVE AI on October 1, 2026 at 19:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to ESR 153.4, Firefox 157, or ESR 140.17, and upgrade Thunderbird to releases 140.17, 153.4, or 157, which contain the JIT fix.
  • Disable WebAssembly execution in the browser configuration if policy allows—for example by setting the appropriate option to false to mitigate the risk when upgrade is not immediately possible.
  • Ensure automatic updates are enabled or apply the vendor patch through an enterprise patch system to keep the browser up to date.

Generated by OpenCVE AI on October 1, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4810-1 thunderbird security update
Debian DLA Debian DLA DLA-4814-1 firefox-esr security update
Debian DSA Debian DSA DSA-6533-1 firefox-esr security update
Debian DSA Debian DSA DSA-6536-1 thunderbird security update
History

Mon, 19 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Thu, 01 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787
CWE-94

Thu, 01 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787
CWE-94

Thu, 01 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-787

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, and Firefox ESR 140.17. JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
References

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, and Firefox ESR 140.17.
References

Wed, 30 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-787

Wed, 30 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 29 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 29 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
Title JIT miscompilation in the JavaScript: WebAssembly component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-01T14:47:37.242Z

Reserved: 2026-09-26T19:17:23.406Z

Link: CVE-2026-100792

cve-icon Vulnrichment

Updated: 2026-10-01T14:47:13.086Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:44.237

Modified: 2026-10-19T15:29:15.073

Link: CVE-2026-100792

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T20:00:12Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')