Description
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Published: 2026-09-29
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via use‑after‑free
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw exists in the JIT component of the JavaScript engine, allowing an attacker to corrupt memory following a freed object and potentially leading to remote code execution. The issue has been fixed in Firefox ESR 153.4, Firefox 157, Thunderbird 157, and Thunderbird 153.4. This weakness is identified as CWE‑416.

Affected Systems

All Mozilla Firefox releases prior to Firefox ESR 153.4 and the non‑ESR Firefox 157 are vulnerable. This includes both Extended Support Release versions older than 153.4 and any mainstream build earlier than 157. Thunderbird versions prior to 153.4 and 157 are also vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high‑severity vulnerability. The EPSS score of 0.0024 indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves malicious JavaScript code delivered to the browser, and exploitation could lead to arbitrary code execution on the client machine.

Generated by OpenCVE AI on September 30, 2026 at 23:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to at least ESR 153.4 or the latest Firefox 157 release to apply the JIT engine fix
  • If immediate upgrade is not feasible, disable or restrict JavaScript execution in browsers that allow granular security settings, thereby limiting the attack surface for malicious code
  • Consider deploying browser security extensions or enforcement policies that block untrusted script execution and monitor for known attack patterns

Generated by OpenCVE AI on September 30, 2026 at 23:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4814-1 firefox-esr security update
Debian DSA Debian DSA DSA-6533-1 firefox-esr security update
History

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, and Firefox 157. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
References

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, and Firefox 157.
References

Tue, 29 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
Title Use-after-free in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-30T17:21:09.522Z

Reserved: 2026-09-26T19:18:45.901Z

Link: CVE-2026-100825

cve-icon Vulnrichment

Updated: 2026-09-29T13:11:13.364Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:47.803

Modified: 2026-10-13T16:11:24.993

Link: CVE-2026-100825

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T00:00:12Z

Weaknesses