CVE-2026-109718
Use-after-free in the XML component.
Published Oct 13, 2026 · updated Oct 15, 2026
Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · OSV.dev
Detected
Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Oct 14, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb13u1
Oct 14, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb13u1
Oct 14, 2026 · OSV.dev
Updated
Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Oct 15, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb12u1; firefox-esr fixed in 153.5.0esr-1~deb13u1
Oct 15, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb12u1
Oct 15, 2026 · OSV.dev
Updated
Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Affected
- Debian:12 firefox-esr0 → 153.5.0esr-1~deb12u1
- Debian:12 firefox-esr102.11.0esr-1, 102.12.0esr-1, 102.12.0esr-1~deb10u1
- Debian:12 thunderbird1:102.11.0-1, 1:102.12.0-1, 1:102.12.0-1~deb10u1
- Debian:13 firefox-esr0 → 153.5.0esr-1~deb13u1
- Debian:13 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1
- Debian:14 firefox-esr128.13.0esr-1, 128.14.0esr-1, 128.14.0esr-1~deb11u1
- Debian:14 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1