Description
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential memory corruption in SVG rendering
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw exists in the SVG component of Mozilla applications. The vulnerability arises when the rendering engine accesses memory that has already been freed, leading to memory corruption. While the description does not explicitly state the exact consequence, such conditions may allow an attacker to inject controlled data or potentially execute code within the user’s context.

Affected Systems

The flaw affects Mozilla Firefox and Mozilla Thunderbird. Versions before 156 of standard releases, or before ESR releases 115.41, 140.16, and 153.3, are vulnerable. Users should verify that they are running a fixed version of either browser or email client.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity impact. The EPSS is less than 1%, implying a very low but non‑zero likelihood that the flaw has been exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of malicious SVG content, either through a web page or a local file, which can trigger the use‑after‑free condition.

Generated by OpenCVE AI on September 20, 2026 at 17:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Mozilla Firefox to 156 or newer, or to any ESR release 115.41, 140.16, or 153.3 or later.
  • Update Mozilla Thunderbird to 156 or newer, or to any ESR release 115.41, 140.16, or 153.3 or later.
  • If an update cannot be applied, consider restricting or disabling SVG content through a content‑security‑policy or application configuration to mitigate the risk of the unchecked rendering of SVG data.

Generated by OpenCVE AI on September 20, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4781-1 firefox-esr security update
Debian DLA Debian DLA DLA-4782-1 thunderbird security update
Debian DSA Debian DSA DSA-6501-1 firefox-esr security update
Debian DSA Debian DSA DSA-6503-1 thunderbird security update
History

Sun, 20 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 17 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
References

Wed, 16 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16. Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
References

Tue, 15 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16.
References

Tue, 15 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
Title Use-after-free in the SVG component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-20T00:19:00.613Z

Reserved: 2026-09-15T12:33:49.345Z

Link: CVE-2026-92029

cve-icon Vulnrichment

Updated: 2026-09-20T00:18:57.624Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T13:16:54.070

Modified: 2026-09-20T01:16:35.747

Link: CVE-2026-92029

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-15T12:33:49Z

Links: CVE-2026-92029 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T18:00:14Z

Weaknesses