Description
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Use‑after‑free leading to possible code execution
Action: Immediate Patch
AI Analysis

Impact

The JavaScript engine in Mozilla products contains a use‑after‑free bug in the WebAssembly component. When a WebAssembly module is loaded, the engine releases a memory region that is later accessed by malicious code, allowing memory corruption or arbitrary code execution. The flaw was addressed in Firefox 158 and Thunderbird 158.

Affected Systems

The flaw affects Mozilla Firefox and Thunderbird. All releases prior to Firefox 158 and Thunderbird 158 are vulnerable. The vulnerability is present in the JavaScript: WebAssembly component of both products.

Risk and Exploitability

The CVSS score is 5.4, indicating a medium severity. The EPSS score is not available, so the exact exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog and has no listed exploitation data. Based on the description, the likely attack vector is a malicious WebAssembly payload delivered over the network to a user’s browser. An attacker with web access could exploit the use‑after‑free to execute arbitrary code, which would give full control of the victim system.

Generated by OpenCVE AI on October 13, 2026 at 20:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox and Thunderbird to version 158 or newer to fix the use‑after‑free vulnerability.
  • If an immediate upgrade is not possible, disable WebAssembly execution in the affected browser or mail client through configuration or policy settings to prevent the vulnerability from being exercised.
  • Use web filtering or intrusion detection to detect and block suspicious WebAssembly payloads until the software can be updated.

Generated by OpenCVE AI on October 13, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158. Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
References

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158.
Title Use-after-free in the JavaScript: WebAssembly component
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:08:25.527Z

Reserved: 2026-10-13T00:48:27.874Z

Link: CVE-2026-109761

cve-icon Vulnrichment

Updated: 2026-10-13T14:13:34.487Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:26.950

Modified: 2026-10-13T19:18:40.260

Link: CVE-2026-109761

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T20:45:19Z

Weaknesses