CVE-2026-109705

CVSS: 9.6v3.1CriticalDeferred

AliasesDEBIAN-CVE-2026-109705

Published 2026-10-13Last modified 2026-10-13

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.6/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.31%

0%100%

Low · Change unavailable

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2026:12116-1

Timeline

2026-10-13
PublishedVulnerability first disclosed.
2026-10-13
Last modifiedVulnerability information updated.

Description

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS metrics

3 scores · 3 sources · 1 version

v3.19.6

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

Change unavailable

2026-10-142026-10-15

EPSS score

0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Debian2 products

firefox-esrAll versions (No fix recorded) | < 153.5.0esr-1~deb12u1 | < 153.5.0esr-1~deb13u1
thunderbirdAll versions (No fix recorded)

1 vendor · 2 products

References

6 links