Description
Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Published: 2026-10-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via WebRTC component
Action: Apply Patch
AI Analysis

Impact

This vulnerability allows an attacker to trigger a denial‑of‑service condition within the WebRTC component of both Mozilla Firefox and Mozilla Thunderbird. An exploit can cause the browser to consume excessive resources or crash, rendering the user’s browser unresponsive. The weakness is a classic uncontrolled resource consumption flaw, reflected by CWE‑400.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird users on any version before 158, and on their ESR releases before 153.5, are affected. The issue is confined to the WebRTC component bundled with these releases.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, and EPSS is not available. The vulnerability is not listed in the CISA KEV catalog, which suggests limited publicly documented exploitation. The likely attack vector is a remote attacker sending malicious WebRTC packets to a victim’s browser. Because no exploitation conditions are reported, the risk is moderate, but the impact of a DoS can be significant for users relying on the browser for critical tasks.

Generated by OpenCVE AI on October 13, 2026 at 20:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Firefox 158 or the ESR 153.5 build, or Thunderbird 158 or Thunderbird 153.5, or any later version that contains the WebRTC fix.
  • If an upgrade is not immediately possible, disable WebRTC via browser settings or a reputable extension to mitigate the risk until a patch is applied.
  • Consider deploying network‑level filters to block or limit WebRTC traffic from untrusted sources as a temporary protection against abuse.

Generated by OpenCVE AI on October 13, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4836-1 firefox-esr security update
Debian DLA Debian DLA DLA-4863-1 thunderbird security update
Debian DSA Debian DSA DSA-6560-1 firefox-esr security update
History

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Denial-of-service in the WebRTC component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:17:26.133Z

Reserved: 2026-10-13T00:49:03.832Z

Link: CVE-2026-109775

cve-icon Vulnrichment

Updated: 2026-10-13T14:06:56.778Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:28.403

Modified: 2026-10-13T19:18:41.880

Link: CVE-2026-109775

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T21:15:16Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption