CVE-2026-117956
Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and
CVSS
8.8
High
EPSS
0.4%
p33
KEV
—
Exploit Today
10
0-100
Published: Oct 27, 2026 · Last modified: Nov 5, 2026 · CWE-824
0.2%EPSS · 30 days0.4%
2026-10-282026-11-06
Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2058659
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-118/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-120/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-121/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-122/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-477385.3 MED—
———liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQS_KEM_encaps_derand can dereference an uninitialized encaps_derand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, or NTRU-HRSS-1373. The affected NTRU constructors omit the OQS_KEM.encaps_derand member because those schemes do not support derandomized encapsulation, OQS_KEM objects are allocated without zero initialization, and the wrapper in src/kem/kem.c checks only that the OQS_KEM pointer is non-null before calling through the residual heap value. An application is affected only if it instantiates one of those six NTRU KEMs and invokes OQS_KEM_encaps_derand on it. The supported impact is a calling-process crash and denial of service. This issue is fixed in version 0.16.0.6hCVE-2026-1179698.8 HIG33.4%
——10Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1179377.3 HIG29.7%
——9Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1179179.8 CRI44.9%
——13Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1179107.3 HIG27.7%
——8Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1178717.3 HIG27.7%
——8Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2d