Description
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

This flaw affects the PDF Viewer component in Mozilla Firefox and can lead to a denial of service when the browser processes a PDF file that triggers the vulnerability (CWE-400). The result is a disruption of the viewer’s normal operation, preventing users from opening or browsing PDF documents until the issue is resolved.

Affected Systems

Mozilla Firefox and Thunderbird installations that are version 158.0.0 or earlier are vulnerable. The security update was introduced in Firefox 158.0.1 and Thunderbird 158.0.1, which incorporate the fix for this defect.

Risk and Exploitability

An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploitation to date. The CVSS score of 6.5 indicates moderate severity. The attack vector is likely remote, involving a malicious PDF document or a web page that loads the PDF into the browser or Thunderbird to trigger the issue. The need for the user to load the PDF limits automatic exploitation, yet the denial of service can affect user experience and session continuity if the flaw surfaces.

Generated by OpenCVE AI on October 20, 2026 at 21:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox or Thunderbird to version 158.0.1 or newer
  • If an upgrade is not immediately possible, disable or block automatic opening of PDF files from untrusted sources to reduce exposure
  • Apply network or endpoint protection that scans or blocks suspicious PDF content at the transport level

Generated by OpenCVE AI on October 20, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1. Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
References

Tue, 20 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Tue, 20 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Tue, 20 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
Title Denial-of-service in the PDF Viewer component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-20T19:14:54.271Z

Reserved: 2026-10-20T06:00:59.236Z

Link: CVE-2026-113401

cve-icon Vulnrichment

Updated: 2026-10-20T14:25:11.596Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T13:16:41.173

Modified: 2026-10-20T20:17:17.223

Link: CVE-2026-113401

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T21:15:14Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption