Description
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption
Action: Apply update
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in the JavaScript WebAssembly component. This flaw can corrupt memory, allowing arbitrary reads or writes. The official description does not specify the precise consequences, so while the CVSS score of 8.8 indicates high severity, it is inferred that the memory corruption could be exploited to alter execution or destabilize the system.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird versions older than 156 are vulnerable; the issue was addressed in Firefox 156 and Thunderbird 156.

Risk and Exploitability

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Based on the description, it is inferred that the attack vector likely involves a malicious web page or email that triggers the buggy WebAssembly component. The high CVSS score of 8.8 combined with the low exploitation probability indicates a significant but not imminent risk for affected users.

Generated by OpenCVE AI on September 20, 2026 at 17:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 156 or later
  • Upgrade Mozilla Thunderbird to version 156 or later
  • Continue monitoring Mozilla security advisories for further updates

Generated by OpenCVE AI on September 20, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Sun, 20 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 17 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

threat_severity

Moderate

Wed, 16 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156. Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
References

Tue, 15 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156.
Title Use-after-free in the JavaScript: WebAssembly component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-20T00:19:35.768Z

Reserved: 2026-09-15T12:34:00.705Z

Link: CVE-2026-92040

cve-icon Vulnrichment

Updated: 2026-09-20T00:19:27.507Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T13:16:55.407

Modified: 2026-10-05T17:52:59.387

Link: CVE-2026-92040

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-15T12:34:01Z

Links: CVE-2026-92040 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T17:30:18Z

Weaknesses