CVE-2026-100771

Analyzed Analyzed - Analysis Complete

Undefined Behavior in Firefox DOM Streams

Publication date: 2026-09-29

Last updated on: 2026-10-06

Assigner: Mozilla Corporation

Description

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100771

EUVD

EUVD-2026-88923

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	From 154.0.0 (inc) to 157.0.0 (exc)
mozilla	thunderbird	From 154.0 (inc) to 157.0 (exc)
mozilla	thunderbird	From 140.0 (inc) to 140.17.0 (exc)
mozilla	thunderbird	From 153.0 (inc) to 153.4.0 (exc)
mozilla	firefox	From 140.0.0 (inc) to 140.17.0 (exc)
mozilla	firefox	From 153.0 (inc) to 153.4.0 (exc)
mozilla	firefox	From 115.0 (inc) to 115.42.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-758	The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

Attack-Flow Graph

Executive Summary

This vulnerability involves undefined behavior in the DOM Streams component of Firefox browsers. It was patched in multiple Firefox versions including ESR 153.4, Firefox 157, ESR 115.42, and ESR 140.17.

Detection Guidance

Detection of this vulnerability requires checking the installed version of Firefox or Firefox ESR. Compare your version against the fixed versions: Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17. Use commands like 'firefox --version' or 'apt show firefox' (Linux) to check the version.

Impact Analysis

Undefined behavior in DOM Streams could lead to crashes, unexpected behavior, or potential security exploits like code execution or data leaks if exploited by attackers.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The description only mentions undefined behavior in the DOM Streams component without detailing potential data exposure or processing risks.

Mitigation Strategies

Update Firefox to version 157 or later, Firefox ESR 115.42 or later, or Firefox ESR 140.17 or later to address the DOM Streams component vulnerability.

Hi! I’m here to help you understand CVE-2026-100771. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70