UBUNTU-CVE-2026-118017: Use After Free
Published Oct 27, 2026
·Updated
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Affected Software
10 affected components
ubuntu/mozjs52*
ubuntu/mozjs38*
ubuntu/mozjs68*
ubuntu/mozjs52*
ubuntu/mozjs102*
ubuntu/mozjs78*
ubuntu/mozjs91*
ubuntu/thunderbird*
ubuntu/mozjs102*
ubuntu/mozjs115*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox and Thunderbirdto a version that resolves this vulnerability.Fixed in 159
Event History
Oct 27, 2026
CVE Published
via OSV·02:16 PM
Data Sourced
via OSV·02:16 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Ubuntu packages are identified as affected?
The listed packages are ubuntu/mozjs38, ubuntu/mozjs52, ubuntu/mozjs68, ubuntu/mozjs78, ubuntu/mozjs91, ubuntu/mozjs102, ubuntu/mozjs115, and ubuntu/thunderbird.
2
Are fixed versions provided for every listed Ubuntu package?
No. The available data states that Firefox 159 and Thunderbird 159 contain fixes, but it does not provide fixed-version information for the listed mozjs packages.
3
What exploit prerequisites or temporary mitigations are documented?
No exploit prerequisites, affected configuration details, detection guidance, or temporary mitigations are provided in the available data.