UBUNTU-CVE-2026-117865: Use After Free
Published Oct 27, 2026
·Updated
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Affected Software
10 affected components
ubuntu/mozjs52*
ubuntu/mozjs38*
ubuntu/mozjs68*
ubuntu/mozjs52*
ubuntu/mozjs102*
ubuntu/mozjs78*
ubuntu/mozjs91*
ubuntu/thunderbird*
ubuntu/mozjs102*
ubuntu/mozjs115*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.6 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 153.6
Event History
Oct 27, 2026
CVE Published
via OSV·02:16 PM
Data Sourced
via OSV·02:16 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Ubuntu packages are identified as affected?
The identified packages are mozjs38, mozjs52, mozjs68, mozjs78, mozjs91, mozjs102, mozjs115, and thunderbird.
2
When was this vulnerability published and last modified?
It was published on 2026-10-27 and last modified on 2026-10-28.