DEBIAN-CVE-2026-117936: Use After Free
Published Oct 27, 2026
·Updated
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Affected Software
6 affected componentsFixes available
debian/firefox-esr<153.6.0esr-1~deb12u2
153.6.0esr-1~deb12u2
debian/firefox-esr<153.6.0esr-1~deb13u1
153.6.0esr-1~deb13u1
debian/firefox-esr*
debian/thunderbird*
debian/thunderbird*
debian/thunderbird*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 153.6.0esr-1~deb12u2 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 153.6.0esr-1~deb13u1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.44 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.6 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.6
Event History
Oct 27, 2026
CVE Published
via OSV·02:16 PM
Data Sourced
via OSV·02:16 PM
DescriptionAffected Software