Description
Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
Published: 2026-09-29
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Moderate severity flaw affecting WebAssembly component
Action: Patch
AI Analysis

Impact

The CVE is described as an ‘Other issue in the JavaScript: WebAssembly component’ with no detailed explanation of how the flaw manifests or the potential for exploitation. The advisory notes that the issue was fixed in Firefox 157 and Thunderbird 157, indicating the problem existed in the WebAssembly handling code of earlier releases. The statement does not provide additional details about the specific impact, and the CVSS score of 5.4 reflects a moderate severity classification for the vulnerability.

Affected Systems

Any installation of Mozilla Firefox or Thunderbird earlier than version 157 is affected. Versions 157 and later contain the applied fix. No additional affected versions are listed.

Risk and Exploitability

The CVSS score of 5.4 classifies the flaw at moderate severity, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the vulnerability involving WebAssembly, it is inferred that a malicious web site could serve a crafted WebAssembly module to trigger the issue, though no public exploits have been reported.

Generated by OpenCVE AI on October 7, 2026 at 09:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest releases of Mozilla Firefox and Thunderbird (157 or newer), which include the WebAssembly patch.
  • If an upgrade cannot be performed immediately, disable WebAssembly by setting javascript.options.wasm to false via about:config to reduce the attack surface.
  • Continue to monitor Mozilla security advisories for further updates or additional mitigation steps.

Generated by OpenCVE AI on October 7, 2026 at 09:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 06 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Fri, 02 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Thu, 01 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Thu, 01 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Thu, 01 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 157. Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
References

Wed, 30 Sep 2026 03:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Tue, 29 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 157.
Title Other issue in the JavaScript: WebAssembly component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-01T15:51:12.113Z

Reserved: 2026-09-26T19:18:26.116Z

Link: CVE-2026-100817

cve-icon Vulnrichment

Updated: 2026-10-01T15:36:31.716Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:46.870

Modified: 2026-10-06T14:35:41.210

Link: CVE-2026-100817

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T09:45:14Z

Weaknesses