UBUNTU-CVE-2026-118006: Use After Free

Published Oct 27, 2026

Updated

Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Affected Software

10 affected components

ubuntu/mozjs52*

ubuntu/mozjs38*

ubuntu/mozjs68*

ubuntu/mozjs52*

ubuntu/mozjs102*

ubuntu/mozjs78*

ubuntu/mozjs91*

ubuntu/thunderbird*

ubuntu/mozjs102*

ubuntu/mozjs115*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 159

Event History

Oct 27, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which installed applications are explicitly identified as fixed versions?

The provided data identifies Firefox 159 and Thunderbird 159 as containing fixes. Of the listed Ubuntu software, only Thunderbird is explicitly named as an affected application with a stated fixed version.

What type of impact does successful exploitation have?

The issue is described as a privilege escalation caused by a use-after-free condition in the WebRTC Signaling component. The provided data does not specify the required attacker access, user interaction, or a workaround when updates cannot be applied.

UBUNTU-CVE-2026-118006: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installed applications are explicitly identified as fixed versions?

What type of impact does successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which installed applications are explicitly identified as fixed versions?

What type of impact does successful exploitation have?