CVE-2026-100788
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 14
CVSS
9.8
Critical
EPSS
0.4%
p35
KEV
—
Exploit Today
11
0-100
Published: Sep 29, 2026 · Last modified: Oct 19, 2026 · CWE-824
0.2%EPSS · 30 days0.4%
2026-09-302026-10-25
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2072413
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-100/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-101/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-102/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-103/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-97/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-99/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1153275.3 MED23.3%
——7libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.4dCVE-2026-1096198.1 HIG100.0%
——30PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).3dCVE-2026-1096189.8 CRI100.0%
——30PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).3dCVE-2026-94018—33.5%
——10The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.6dCVE-2026-868476.5 MED8.1%
——2A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.6dCVE-2026-1106036.3 MED6.4%
——2LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.10d