CVE-2026-117917
Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Th
CVSS
9.8
Crítica
EPSS
0.5%
p45
KEV
—
Exploit Today
13
0-100
Publicado: 27 de out. de 2026 · Última mod.: 4 de nov. de 2026 · CWE-824
0.2%EPSS · 30 dias0.5%
2026-10-282026-11-06
Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2079301
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-118/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-119/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-120/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-121/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-122/
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-477385.3 MÉD—
———liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQS_KEM_encaps_derand can dereference an uninitialized encaps_derand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, or NTRU-HRSS-1373. The affected NTRU constructors omit the OQS_KEM.encaps_derand member because those schemes do not support derandomized encapsulation, OQS_KEM objects are allocated without zero initialization, and the wrapper in src/kem/kem.c checks only that the OQS_KEM pointer is non-null before calling through the residual heap value. An application is affected only if it instantiates one of those six NTRU KEMs and invokes OQS_KEM_encaps_derand on it. The supported impact is a calling-process crash and denial of service. This issue is fixed in version 0.16.0.6hCVE-2026-1179698.8 ALT33.4%
——10Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1179568.8 ALT33.4%
——10Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1179377.3 ALT29.7%
——9Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1179107.3 ALT27.7%
——8Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2dCVE-2026-1178717.3 ALT27.7%
——8Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.2d