CVE-2026-92023 - Vulnerability Details

Description

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Published: 2026-09-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An use‑after‑free flaw exists in the XML component or crafted XML, leading to memory corruption which may cause application instability or compromise the integrity of the affected process.

Affected Systems

Mozilla Firefox and Thunderbird releases before Firefox 156, Firefox ESR 115.41, 140.16, or 153.3 and before Thunderbird 156 or Thunderbird ESR 140.16. The flaw has been fixed in those patched versions and subsequent releases.

Risk and Exploitability

The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the bug is not listed in the CISA KEV catalog. Because the description does not specify how the flaw is triggered, the likely attack vector is inferred to be a remote delivery of malicious XML content—such as via a web page, email attachment, or any other untrusted source that forces the client to parse XML. Even without documented public exploitation, an attacker could potentially exploit the affected process to cause instability or memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.41`	unaffected	≤ 115.*
`140.16`	unaffected	≤ 140.*
`153.3`	unaffected	≤ 153.*
`156`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.16`	unaffected	≤ 140.*
`153.3`	unaffected	≤ 153.*
`156`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[115.41,116.0.0)`	unaffected	generic	—
`[140.16,141.0.0)`	unaffected	generic	—
`[153.3,154.0.0)`	unaffected	generic	—
`[156,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to the latest Firefox release (v156 or newer) or to Firefox ESR 115.41 or newer.
Update to the latest Thunderbird release (v156 or newer) or to Thunderbird ESR 140.16 or newer.
If an update cannot be applied immediately, disable or restrict XML parsing of untrusted content in configuration or policy settings.

Generated by OpenCVE AI on September 20, 2026 at 17:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4781-1	firefox-esr security update
Debian DLA	DLA-4782-1	thunderbird security update
Debian DSA	DSA-6501-1	firefox-esr security update
Debian DSA	DSA-6503-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0034.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2068342
https://nvd.nist.gov/vuln/detail/CVE-2026-92023
https://www.cve.org/CVERecord?id=CVE-2026-92023
https://www.mozilla.org/security/advisories/mfsa2026-90/
https://www.mozilla.org/security/advisories/mfsa2026-91/
https://www.mozilla.org/security/advisories/mfsa2026-92/
https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92023
https://www.mozilla.org/security/advisories/mfsa2026-93/
https://www.mozilla.org/security/advisories/mfsa2026-94/
https://www.mozilla.org/security/advisories/mfsa2026-95/
https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92023
https://www.mozilla.org/security/advisories/mfsa2026-96/

History

Sun, 20 Sep 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 17 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-92023 https://www.cve.org/CVERecord?id=CVE-2026-92023 https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92023 https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92023
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
References		https://www.mozilla.org/security/advisories/mfsa2026-96/

Wed, 16 Sep 2026 07:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 15 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16.	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
References		https://www.mozilla.org/security/advisories/mfsa2026-94/

Tue, 15 Sep 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16.
References		https://www.mozilla.org/security/advisories/mfsa2026-95/

Tue, 15 Sep 2026 14:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
Title		Use-after-free in the XML component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2068342 https://www.mozilla.org/security/advisories/mfsa2026-90/ https://www.mozilla.org/security/advisories/mfsa2026-91/ https://www.mozilla.org/security/advisories/mfsa2026-92/ https://www.mozilla.org/security/advisories/mfsa2026-93/

Subscriptions

Mozilla Firefox

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-09-15T12:33:43.613Z

Updated: 2026-09-20T00:17:36.855Z

Reserved: 2026-09-15T12:33:43.103Z

Link: CVE-2026-92023

Vulnrichment

Updated: 2026-09-20T00:17:27.816Z

NVD

Status : Awaiting Analysis

Published: 2026-09-15T13:16:52.487

Modified: 2026-09-20T01:16:35.217

Link: CVE-2026-92023

Redhat

Severity : Important

Publid Date: 2026-09-15T12:33:43Z

Links: CVE-2026-92023 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-20T18:00:14Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object