CVE-2026-0882: Use-after-free in the IPC component
Use-after-free in the IPC component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, and Firefox ESR < 140.7.
Other sources
Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.32 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 147 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.7 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 160.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 147 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.32 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.7 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 147 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-0882?
CVE-2026-0882 has been rated as a high-severity vulnerability due to its potential to exploit memory corruption.
How do I fix CVE-2026-0882?
To fix CVE-2026-0882, update to Firefox version 147 or Firefox ESR versions 140.7 or 115.32.
What systems are affected by CVE-2026-0882?
CVE-2026-0882 affects Firefox versions below 147 and Firefox ESR versions below 115.32 and 140.7.
Can CVE-2026-0882 lead to remote code execution?
Yes, CVE-2026-0882 can potentially lead to remote code execution due to the use-after-free vulnerability.
Is CVE-2026-0882 a common vulnerability in browsers?
Use-after-free vulnerabilities like CVE-2026-0882 are common in browsers and can pose significant security risks.