Description
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption
Action: Patch
AI Analysis

Impact

The vulnerability arises from incorrect boundary checks in the Just‑In‑Time (JIT) component of the JavaScript engine. The CVE description indicates that the issue has been fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5, implying that these releases contain the necessary patch. While the description does not explicitly state the outcomes, the nature of incorrect boundaries suggests that memory corruption might be possible in such scenarios, and the associated CWE (CWE‑119) highlights potential risks.

Affected Systems

The flaw affects Mozilla Firefox and Mozilla Thunderbird versions older than 158 and ESR 153.5. Any build of these products that predates the stated versions is vulnerable when rendering JavaScript. Users running earlier releases are at risk while browsing web content that contains malicious scripts.

Risk and Exploitability

The EPSS score of < 1% indicates a very low probability of exploitation at this time, and the CVSS score of 5.4 reflects moderate overall risk. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the bug could be triggered by malicious JavaScript executed in a browser context, although the precise exploitation outcome is not detailed. The potential impact could involve memory corruption, as suggested by the associated CWE.

Generated by OpenCVE AI on October 19, 2026 at 16:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to at least version 158 or to the ESR 153.5 release to apply the fix.
  • Upgrade Mozilla Thunderbird to at least version 158 or to the ESR 153.5 release to apply the fix.
  • Continuously monitor Mozilla security advisories and apply future updates promptly to ensure the patch is not superseded by newer vulnerabilities.

Generated by OpenCVE AI on October 19, 2026 at 16:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4836-1 firefox-esr security update
Debian DLA Debian DLA DLA-4863-1 thunderbird security update
Debian DSA Debian DSA DSA-6560-1 firefox-esr security update
History

Mon, 19 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-188
CWE-787

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-188
CWE-787

Wed, 14 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-215

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References

Tue, 13 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-215

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Incorrect boundary conditions in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-19T11:07:12.043Z

Reserved: 2026-10-13T00:29:28.830Z

Link: CVE-2026-109721

cve-icon Vulnrichment

Updated: 2026-10-19T11:06:51.606Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:22.590

Modified: 2026-10-19T12:16:57.070

Link: CVE-2026-109721

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:45:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer