CVE-2026-117862

CriticalCVSS 9.8/10Last modified Nov 4, 2026

Description

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Oct 27, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1178636.5Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 11CVE-2026-1178648.8Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and ThunderbiCVE-2026-1178656.3Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and ThunderCVE-2026-1178667.3Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115CVE-2026-1178677.3Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,CVE-2026-1178689.6Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, ThunderCVE-2026-1178698.8Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, ThundeCVE-2026-117876.3A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, cauCVE-2026-1178707.3Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, ThundCVE-2026-1178717.3Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird CVE-2026-1178728.8Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 1CVE-2026-1178738.1Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firef
CVE-2026-117862: Critical severity, CVSS 9.8 | Vulnix