Description
Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Published: 2026-10-13
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

This vulnerability allows the PDF viewer component in Firefox and Thunderbird to unintentionally disclose sensitive information, compromising data confidentiality, and could expose user data to attackers.

Affected Systems

Mozilla Firefox browsers older than version 158, Firefox ESR releases earlier than 153.5, Thunderbird versions older than 158, and Thunderbird ESR releases earlier than 153.5 are potentially affected.

Risk and Exploitability

The CVSS score is 4.3, indicating a low severity vulnerability. With no publicly disclosed exploits and no EPSS score, the exact likelihood of exploitation remains uncertain, but the information‑disclosure nature of the PDF viewer component in Mozilla Firefox and Thunderbird warrants patching, especially for users handling confidential material.

Generated by OpenCVE AI on October 13, 2026 at 20:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 158 or later and upgrade Thunderbird to version 158 or later, or to ESR 153.5 or later.
  • If an upgrade is not immediately possible, disable or restrict the built‑in PDF viewer in Firefox and Thunderbird and use a third‑party PDF reader instead.
  • Maintain regular security updates across the system to ensure all components remain protected.

Generated by OpenCVE AI on October 13, 2026 at 20:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4836-1 firefox-esr security update
Debian DLA Debian DLA DLA-4863-1 thunderbird security update
Debian DSA Debian DSA DSA-6560-1 firefox-esr security update
History

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Information disclosure in the PDF Viewer component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:17:05.468Z

Reserved: 2026-10-13T00:29:47.751Z

Link: CVE-2026-109742

cve-icon Vulnrichment

Updated: 2026-10-13T14:57:52.879Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:24.923

Modified: 2026-10-13T19:18:38.287

Link: CVE-2026-109742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T20:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor