UBUNTU-CVE-2026-124872: Use After Free
Use-after-free in the Cycle Collector component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.45 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.7 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.7
Event History
Frequently Asked Questions
Which Ubuntu packages should be reviewed for exposure?
The affected software list includes ubuntu/thunderbird and the Ubuntu mozjs packages mozjs38, mozjs52, mozjs68, mozjs78, mozjs91, mozjs102, and mozjs115. Review installed versions and Ubuntu security updates for each package deployed in your environment.
Which upstream releases contain the fix?
The issue was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. The provided data does not identify the corresponding Ubuntu package versions.
How can I determine whether a system is already vulnerable?
Check whether an affected Ubuntu package is installed and whether its available Ubuntu security update includes the CVE fix. The supplied information does not provide package build numbers or other indicators for confirming remediation locally.