UBUNTU-CVE-2026-117909: Use After Free

Published Oct 27, 2026

Updated

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Affected Software

10 affected components

ubuntu/mozjs52*

ubuntu/mozjs38*

ubuntu/mozjs68*

ubuntu/mozjs52*

ubuntu/mozjs102*

ubuntu/mozjs78*

ubuntu/mozjs91*

ubuntu/thunderbird*

ubuntu/mozjs102*

ubuntu/mozjs115*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.6
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.6

Event History

Oct 27, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu packages should be reviewed for exposure?

The affected software list includes ubuntu/thunderbird and the ubuntu/mozjs38, ubuntu/mozjs52, ubuntu/mozjs68, ubuntu/mozjs78, ubuntu/mozjs91, ubuntu/mozjs102, and ubuntu/mozjs115 packages.

Which upstream releases contain the fix?

The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.