Description
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
Published: 2026-09-29
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption
Action: Apply Patch
AI Analysis

Impact

An invalid pointer in the JavaScript engine’s just‑in‑time (JIT) component was identified. This type of pointer error can corrupt memory during the compilation or execution of JavaScript code. Because the CVE description does not specify the exact consequences, it is understood that the impact could involve memory corruption, potentially leading to unintended program behavior or failures.

Affected Systems

Mozilla Firefox users who are running browser versions earlier than 157 are affected, as the issue was fixed in Firefox 157. Mozilla Thunderbird users who are running Thunderbird versions earlier than 157 are also affected, as the issue was fixed in Thunderbird 157.

Risk and Exploitability

The CVSS score of 8.8 indicates a high‑severity vulnerability. The EPSS score is <1%, indicating that the exploitation probability is very low, and the vulnerability is not listed in CISA KEV. The likely attack vector is inferred to be malicious JavaScript delivered via a web page or plugin, which would trigger execution of the vulnerable JIT code in both Firefox and Thunderbird and potentially result in memory corruption.

Generated by OpenCVE AI on October 1, 2026 at 00:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 157 or later or upgrade Mozilla Thunderbird to version 157 to obtain the fix.
  • If an immediate upgrade is not possible, disable the JIT component by setting the preference javascript.options.baselinejit to false to reduce the risk surface.
  • Review and limit JavaScript execution contexts, and monitor extensions for suspicious activity until the patch can be applied.

Generated by OpenCVE AI on October 1, 2026 at 00:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 157. Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
References

Tue, 29 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-763
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 157.
Title Invalid pointer in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-30T17:15:00.715Z

Reserved: 2026-09-26T19:18:16.109Z

Link: CVE-2026-100813

cve-icon Vulnrichment

Updated: 2026-09-29T14:25:34.758Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:46.440

Modified: 2026-10-05T17:01:04.000

Link: CVE-2026-100813

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T00:15:14Z

Weaknesses
  • CWE-763

    Release of Invalid Pointer or Reference