Description
Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Published: 2026-10-13
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

This vulnerability allows the PDF viewer component in Firefox to unintentionally disclose sensitive information, compromising data confidentiality, and could expose user data to attackers.

Affected Systems

Mozilla Firefox browsers older than version 158 and Firefox ESR releases earlier than version 153.5 are potentially affected.

Risk and Exploitability

The CVSS score is 4.3, indicating a low severity vulnerability. With no publicly disclosed exploits and no EPSS score, the exact likelihood of exploitation remains uncertain, but the vulnerability’s information‑disclosure nature warrants patching, especially for users handling confidential material.

Generated by OpenCVE AI on October 13, 2026 at 17:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 158 or later, or to ESR 153.5 or later.
  • If an upgrade is not immediately possible, disable or restrict the built‑in PDF viewer and use a third‑party PDF reader instead.
  • Maintain regular security updates across the system to ensure all components remain protected.

Generated by OpenCVE AI on October 13, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Information disclosure in the PDF Viewer component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:17:05.468Z

Reserved: 2026-10-13T00:29:47.751Z

Link: CVE-2026-109742

cve-icon Vulnrichment

Updated: 2026-10-13T14:57:52.879Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:24.923

Modified: 2026-10-13T16:19:16.897

Link: CVE-2026-109742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:30:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor