UBUNTU-CVE-2026-124904: Use After Free
Published Nov 12, 2026
·Updated
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Affected Software
10 affected components
ubuntu/mozjs52*
ubuntu/mozjs38*
ubuntu/mozjs68*
ubuntu/mozjs52*
ubuntu/mozjs102*
ubuntu/mozjs78*
ubuntu/mozjs91*
ubuntu/thunderbird*
ubuntu/mozjs102*
ubuntu/mozjs115*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Ubuntu packages should be reviewed for exposure?
The affected software list includes ubuntu/thunderbird and the Ubuntu mozjs packages mozjs38, mozjs52, mozjs68, mozjs78, mozjs91, mozjs102, and mozjs115.
2
What fixed versions are identified for this issue?
The vulnerability was fixed in Firefox 160 and Thunderbird 160. No fixed Ubuntu package versions are provided in the available data.
3
What is the vulnerability class and severity?
This is a use-after-free vulnerability in an SVG component, classified under CWE Use After Free. It is rated medium severity with a score of 4.