DEBIAN-CVE-2026-117985: Use After Free

Q: Which Debian packages should be prioritized for updates?

Debian systems using firefox-esr or thunderbird should be updated to versions that include the upstream fixes. The vulnerability is fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Q: What is the security impact of successful exploitation?

Successful exploitation can allow an attacker to escape the application sandbox through a use-after-free flaw in the Graphics component.

Published Oct 27, 2026

Updated

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Affected Software

6 affected componentsFixes available

debian/firefox-esr<153.6.0esr-1~deb12u2

153.6.0esr-1~deb12u2

debian/firefox-esr<153.6.0esr-1~deb13u1

153.6.0esr-1~deb13u1

debian/firefox-esr*

debian/thunderbird*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 153.6.0esr-1~deb12u2
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 153.6.0esr-1~deb13u1
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.6
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Thunderbird ESR to a version that resolves this vulnerability.
Fixed in 153.6

Event History

Oct 27, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionAffected Software

Frequently Asked Questions

Which Debian packages should be prioritized for updates?

Debian systems using firefox-esr or thunderbird should be updated to versions that include the upstream fixes. The vulnerability is fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

What is the security impact of successful exploitation?

Successful exploitation can allow an attacker to escape the application sandbox through a use-after-free flaw in the Graphics component.

DEBIAN-CVE-2026-117985: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Debian packages should be prioritized for updates?

What is the security impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Debian packages should be prioritized for updates?

What is the security impact of successful exploitation?