CVE-2019-17026

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 68.4.1
Mozilla	Thunderbird	>= unspecified, < 68.4.1
Mozilla	Firefox	>= unspecified, < 72.0.1

References

http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.htmlExploit, Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1607443Issue Tracking
https://security.gentoo.org/glsa/202003-02Third Party Advisory
https://usn.ubuntu.com/4335-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2020-03/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-04/Vendor Advisory
http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.htmlExploit, Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1607443Issue Tracking
https://security.gentoo.org/glsa/202003-02Third Party Advisory
https://usn.ubuntu.com/4335-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2020-03/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-04/Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17026US Government Resource

Timeline

Published: Mar 2, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-17038.6A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 210 CVE-2019-17047.5Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) S CVE-2019-170409.8contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.CVE-2019-170419.8An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log CVE-2019-170429.8An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. CVE-2019-170437.8An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker CVE-2019-170447.8An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with CVE-2019-170454.8Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.CVE-2019-170467.2Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page.CVE-2019-170497.5NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.CVE-2019-17055.9A vulnerability in the remote access VPN session manager of Cisco Adaptive Security Appliance (ASA) Software could allow a unauthenticated, CVE-2019-170507.2An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or d