ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109775

Denial-of-service in the WebRTC component.

Published Oct 13, 2026 · updated Oct 15, 2026

Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · OSV.dev

    Detected

    Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  2. Oct 14, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb13u1

  3. Oct 14, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb13u1

  4. Oct 14, 2026 · OSV.dev

    Updated

    Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  5. Oct 15, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb12u1; firefox-esr fixed in 153.5.0esr-1~deb13u1

  6. Oct 15, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb12u1

  7. Oct 15, 2026 · OSV.dev

    Updated

    Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Affected

  • Debian:12 firefox-esr0 → 153.5.0esr-1~deb12u1
  • Debian:12 firefox-esr102.11.0esr-1, 102.12.0esr-1, 102.12.0esr-1~deb10u1
  • Debian:12 thunderbird1:102.11.0-1, 1:102.12.0-1, 1:102.12.0-1~deb10u1
  • Debian:13 firefox-esr0 → 153.5.0esr-1~deb13u1
  • Debian:13 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1
  • Debian:14 firefox-esr128.13.0esr-1, 128.14.0esr-1, 128.14.0esr-1~deb11u1
  • Debian:14 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1

Sources

References

CVE-2026-109775 · ZeroDay Findings