CVE-2026-15718

Invalid pointer in the JavaScript: WebAssembly component

Published Jul 14, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

Analysis

Technical impact

The vulnerability involves an invalid pointer that is used during the execution of a WebAssembly module by Firefox's JavaScript engine. Such a mis‑specified pointer can corrupt memory or trigger a crash. Public exploit code demonstrates that a malicious WebAssembly payload could trigger the vector, and if executed could corrupt memory, potentially enabling arbitrary code execution if an attacker can influence the WebAssembly that is executed.

Affected Systems

Both Mozilla Firefox and Thunderbird are affected; the advisory indicates that versions earlier than Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13 are vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1 % implies a low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog, and no wild attacks have been reported. Public exploit code exists, but the modest CVSS and very low EPSS suggest that the practical risk remains low to moderate at this time.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.13`	unaffected	≤ 140.*
`152.0.6`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.13`	unaffected	≤ *

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[152.0.6,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox ESR to 140.13 or newer, as it receives security updates.
Upgrade Thunderbird to 140.13 or newer.
Upgrade Mozilla Firefox to 152.0.6 or newer.
If an update cannot be applied immediately, disable WebAssembly execution by setting the about:config preference "javascript.options.wasm" to false or use an extension to block WebAssembly.
Continuously monitor Mozilla’s security advisories and apply any subsequent patches or work‑arounds as they become available.

Generated by OpenCVE AI on August 3, 2026 at 03:29 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4695-1	firefox-esr security update
Debian DLA	DLA-4727-1	thunderbird security update
Debian DSA	DSA-6394-1	firefox-esr security update
Debian DSA	DSA-6418-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.489% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2045443
https://nvd.nist.gov/vuln/detail/CVE-2026-15718
https://www.cve.org/CVERecord?id=CVE-2026-15718
https://www.mozilla.org/security/advisories/mfsa2026-67/
https://www.mozilla.org/security/advisories/mfsa2026-70/
https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718
https://www.mozilla.org/security/advisories/mfsa2026-72/
https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718

History

Jul 24, 2026 12:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-15718 https://www.cve.org/CVERecord?id=CVE-2026-15718 https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718 https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718
Metrics	threat_severity `None`	threat_severity `Critical`

Jul 22, 2026 8:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6 and Firefox ESR 140.13.	We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.
References		https://www.mozilla.org/security/advisories/mfsa2026-72/

Jul 21, 2026 12:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.	We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6 and Firefox ESR 140.13.
References		https://www.mozilla.org/security/advisories/mfsa2026-70/

Jul 14, 2026 2:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-763
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 1:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Jul 14, 2026 12:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.
Title		Invalid pointer in the JavaScript: WebAssembly component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2045443 https://www.mozilla.org/security/advisories/mfsa2026-67/