DEBIAN-CVE-2026-117866: Use After Free

Published Oct 27, 2026

Updated

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Affected Software

6 affected componentsFixes available

debian/firefox-esr<153.6.0esr-1~deb12u2

153.6.0esr-1~deb12u2

debian/firefox-esr<153.6.0esr-1~deb13u1

153.6.0esr-1~deb13u1

debian/firefox-esr*

debian/thunderbird*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 153.6.0esr-1~deb12u2
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 153.6.0esr-1~deb13u1
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Firefox ESR 115 to a version that resolves this vulnerability.
Fixed in 115.44
Upgrade
Upgrade Firefox ESR 153 to a version that resolves this vulnerability.
Fixed in 153.6
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Thunderbird 153 to a version that resolves this vulnerability.
Fixed in 153.6

Event History

Oct 27, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionAffected Software

DEBIAN-CVE-2026-117866: Use After Free

Affected Software

Remediation

Event History

Company

Resources

Contact