CVE-2026-109776

CVSS: 4.2v3.1MediumDeferred

AliasesDEBIAN-CVE-2026-109776

Published 2026-10-13Last modified 2026-10-15

Open JSON

Vulnerability summary

Overall risk

17/100

0100

Low · default modelHow is this calculated?

CVSS score

4.2/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.19%

0%100%

Low · Change unavailable

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2026:12116-1

Timeline

2026-10-13
PublishedVulnerability first disclosed.
2026-10-15
Last modifiedVulnerability information updated.

Description

Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS metrics

2 scores · 2 sources · 1 version

v3.14.2

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Change unavailable

2026-10-142026-10-15

EPSS score

0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Debian2 products

firefox-esrAll versions (No fix recorded) | < 153.5.0esr-1~deb12u1 | < 153.5.0esr-1~deb13u1
thunderbirdAll versions (No fix recorded)

1 vendor · 2 products

References

6 links