Description
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Published: 2026-10-27
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Upgrade
AI Analysis

Impact

The vulnerability involves an invalid pointer reference within Mozilla's JavaScript engine. This flaw can cause a dereference error, which may lead to a crash or a denial‑of‑service condition. The CVE description does not confirm arbitrary code execution, and no specific weakness is cited beyond the pointer error.

Affected Systems

This issue affects Mozilla Firefox versions prior to 159 and the ESR 153.6 release. Any browser incorporating the affected JavaScript engine component is susceptible until the fix is applied.

Risk and Exploitability

No EPSS data is available for this vulnerability, and it is not listed in the CISA KEV catalog. Because there is no publicly documented exploit and the impact is limited to crashes or denial of service, the immediate threat level is moderate. The attack vector is inferred to be local or remote, depending on the ability to serve malicious JavaScript to the vulnerable engine.

Generated by OpenCVE AI on October 27, 2026 at 17:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Mozilla Firefox update (at least version 159 or ESR 153.6).
  • If an upgrade is unavailable, consider disabling JavaScript or restricting its execution to reduce exposure.
  • Monitor system logs for repeated crashes or anomalous behavior that could indicate exploitation attempts.

Generated by OpenCVE AI on October 27, 2026 at 17:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, and Thunderbird 159. Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References

Tue, 27 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, and Thunderbird 159.
References

Tue, 27 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Title Invalid pointer in the JavaScript Engine component
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-27T18:28:48.699Z

Reserved: 2026-10-27T14:05:21.892Z

Link: CVE-2026-117910

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T14:16:46.440

Modified: 2026-10-27T19:17:16.260

Link: CVE-2026-117910

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T17:15:06Z

Weaknesses