CVE-2026-113401: Denial-of-service in the PDF Viewer component
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates network access is sufficient, attack complexity is low, and no attacker privileges are required. Exploitation requires user interaction.
What is the operational impact of successful exploitation?
The issue affects availability, with a high availability impact in the CVSS assessment. The provided assessment indicates no confidentiality or integrity impact.
Which releases contain the fix?
Mozilla identifies Firefox 158.0.1 and Thunderbird 158.0.1 as containing the fix. Verify the installed version for each deployed product when confirming remediation.