Description
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw located in the JavaScript engine’s Just‑In‑Time (JIT) component can allow an attacker to corrupt memory after a freed object is reused. If an attacker can supply malicious JavaScript code that reaches the vulnerable JIT sub‑component, the flaw could lead to arbitrary code execution or a crash, compromising confidentiality, integrity.

Affected Systems

Affected systems are Mozilla Firefox and Mozilla Thunderbird. The flaw was fixed in Firefox ESR 140.16 and Thunderbird 140.16; versions prior to these contain the vulnerability.

Risk and Exploitability

The EPSS score is available and indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Because the flaw the attack vector involves execution of crafted JavaScript, possibly delivered via web content or email attachments. The severity is high owing to its memory‑corruption nature, but the EPSS score suggests exploitation is unlikely. The updated CVSS score is 8.8.

Generated by OpenCVE AI on September 20, 2026 at 17:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Firefox to ESR 140.16 or later
  • If an upgrade cannot be applied immediately, disable the Just‑In‑Time compiler by setting the appropriate configuration option (e.g., javascript.options.baselinejit to false) to mitigate the memory‑corruption risk
  • Apply standard web‑content filtering or restrict JavaScript execution from untrusted sources to reduce exposure to malicious scripts

Generated by OpenCVE AI on September 20, 2026 at 17:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4781-1 firefox-esr security update
Debian DLA Debian DLA DLA-4782-1 thunderbird security update
Debian DSA Debian DSA DSA-6501-1 firefox-esr security update
Debian DSA Debian DSA DSA-6503-1 thunderbird security update
History

Sun, 20 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 16 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 15 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
References

Tue, 15 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16.
Title Use-after-free in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-20T00:16:45.726Z

Reserved: 2026-09-15T12:33:40.656Z

Link: CVE-2026-92021

cve-icon Vulnrichment

Updated: 2026-09-20T00:16:41.386Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T13:16:52.210

Modified: 2026-09-20T01:16:34.863

Link: CVE-2026-92021

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-15T12:33:41Z

Links: CVE-2026-92021 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T17:30:18Z

Weaknesses