UBUNTU-CVE-2026-124867: Use After Free
Published Nov 12, 2026
·Updated
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Affected Software
10 affected components
ubuntu/mozjs52*
ubuntu/mozjs38*
ubuntu/mozjs68*
ubuntu/mozjs52*
ubuntu/mozjs102*
ubuntu/mozjs78*
ubuntu/mozjs91*
ubuntu/thunderbird*
ubuntu/mozjs102*
ubuntu/mozjs115*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Ubuntu packages are identified for review?
The record lists ubuntu/mozjs38, ubuntu/mozjs52, ubuntu/mozjs68, ubuntu/mozjs78, ubuntu/mozjs91, ubuntu/mozjs102, ubuntu/mozjs115, and ubuntu/thunderbird.
2
Does the record provide Ubuntu package versions to determine whether a system is affected or fixed?
No. It does not provide affected or fixed Ubuntu package version numbers. It only states that the issue was fixed in Firefox 160 and Thunderbird 160.