Description
Race condition in the IPC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Published: 2026-10-27
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a race condition in the IPC component of Mozilla Firefox. The race condition can lead to unexpected behavior, including crashes or inconsistent data handling, which may allow an attacker to cause a denial of service or compromise application stability. The weakness is a classic race condition affecting shared resources; specific outcomes depend on how the IPC component is used in applications.

Affected Systems

Mozilla Firefox is affected. Versions prior to 159 and Firefox ESR prior to 153.6 contain the race condition. It was fixed starting with Firefox 159 and ESR 153.6, so any earlier build remains vulnerable.

Risk and Exploitability

The official EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided, so the severity cannot be quantified here. Based on the race condition nature, exploitation would likely require a scenario where the attacker can trigger concurrent IPC operations, possibly from a local user or a privileged application. The attack vector is inferred to be local or remote depending on the accessibility of the IPC interface, but the description does not specify an exact vector or step-by-step exploitation process.

Generated by OpenCVE AI on October 27, 2026 at 16:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Mozilla Firefox to the latest release version 159 or later, or upgrade to Firefox ESR 153.6 or newer, to patch the race condition.
  • If an immediate upgrade is not possible, disable or restrict the use of the IPC component in affected applications to prevent concurrent access that could trigger the race condition.
  • Monitor application logs and system behavior for unexpected crashes or abnormal IPC activity, and ensure that only trusted code can interact with the IPC interface.

Generated by OpenCVE AI on October 27, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 27 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-399

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Race condition in the IPC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Title Race condition in the IPC component
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-27T14:37:17.184Z

Reserved: 2026-10-27T14:05:55.394Z

Link: CVE-2026-117999

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T14:16:57.807

Modified: 2026-10-27T15:00:49.240

Link: CVE-2026-117999

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T17:15:05Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-399