Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Use‑after‑free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. An attacker could exploit the ability to access memory that has already been freed, potentially leading to memory corruption, arbitrary code execution, or a denial‑of‑service crash. The weakness is a classic instance of improper memory management.

Affected Systems

Affected systems are Mozilla Firefox and its Extended Support Release channels, and Mozilla Thunderbird. Versions earlier than Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5 are vulnerable. All users of those releases should consider the upgrade path.

Risk and Exploitability

The CVSS score is 5.4, indicating a moderate risk level, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, so the exact exploitation probability is unknown. Based on the nature of DOM vulnerabilities, the likely attack vector is a malicious web page accessed by the user. The lack of a public exploit does not eliminate the risk, and patching remains the most reliable defense.

Generated by OpenCVE AI on October 17, 2026 at 07:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 158 or later, or to at least ESR 115.43 or ESR 153.5.
  • Upgrade Mozilla Thunderbird to version 158 or later, or to at least ESR 115.43 or ESR 153.5.
  • Enable automatic updates to ensure timely receipt of security patches.
  • If an upgrade is not immediately possible, avoid loading untrusted web content and consider restricting JavaScript execution for untrusted sites.

Generated by OpenCVE AI on October 17, 2026 at 07:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4836-1 firefox-esr security update
Debian DLA Debian DLA DLA-4863-1 thunderbird security update
Debian DSA Debian DSA DSA-6560-1 firefox-esr security update
History

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Title Use-after-free in the DOM: Core & HTML component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:16:33.964Z

Reserved: 2026-10-13T00:29:32.160Z

Link: CVE-2026-109725

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:23.010

Modified: 2026-10-13T19:18:36.267

Link: CVE-2026-109725

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:15:04Z

Weaknesses