CVE-2026-109715

Deferred Deferred - Pending Action

Memory Corruption in Firefox JavaScript Engine

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Mozilla Corporation

Description

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109715

EUVD

EUVD-2026-98638

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 158 (inc)
mozilla	firefox_esr	to 115.43 (inc)
mozilla	firefox_esr	to 153.5 (inc)
mozilla	firefox	158
mozilla	firefox_esr	115.43
mozilla	firefox_esr	153.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect boundary conditions in the JavaScript Engine component of Firefox browsers. It was patched in Firefox 158 and Firefox ESR versions 115.43 and 153.5.

Detection Guidance

This vulnerability is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. Check your Firefox version by running 'firefox --version' or 'about:support' in the browser. If your version is below these, update immediately.

Impact Analysis

An attacker could exploit this flaw to execute arbitrary code or cause a denial of service by triggering boundary condition errors in the JavaScript Engine.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves incorrect boundary conditions in the JavaScript Engine, which could potentially lead to memory corruption or crashes. Without explicit details on data exposure or processing impacts, its compliance implications remain unclear.

Mitigation Strategies

Update Firefox to version 158 or later, Firefox ESR to version 115.43 or later, or Firefox ESR to version 153.5 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-109715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70