CVE-2026-109765 - Vulnerability Details - OpenCVE

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`153.5`	unaffected	≤ 153.*
`158`	unaffected	≤ *

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2073396
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-108/

History

Tue, 13 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title		Race condition, use-after-free in the Graphics: Text component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2073396 https://www.mozilla.org/security/advisories/mfsa2026-106/ https://www.mozilla.org/security/advisories/mfsa2026-108/

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-10-13T12:29:32.427Z

Updated: 2026-10-13T14:08:58.343Z

Reserved: 2026-10-13T00:48:37.689Z

Link: CVE-2026-109765

Vulnrichment

Updated: 2026-10-13T14:08:49.792Z

NVD

Status : Received

Published: 2026-10-13T13:17:27.360

Modified: 2026-10-13T15:17:41.697

Link: CVE-2026-109765

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109765", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-10-13T00:48:37.689Z", "datePublished": "2026-10-13T12:29:32.427Z", "dateUpdated": "2026-10-13T14:08:58.343Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "153.5", "lessThanOrEqual": "153.*", "versionType": "rpm"}, {"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5."}]}], "title": "Race condition, use-after-free in the Graphics: Text component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073396"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"}], "credits": [{"lang": "en", "value": "Shu Takahashi of Velcore Consulting Inc."}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-13T12:29:32.427Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}, {"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T14:08:55.001726Z", "id": "CVE-2026-109765", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T14:08:58.343Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109765", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-10-13T00:48:37.689Z", "datePublished": "2026-10-13T12:29:32.427Z", "dateUpdated": "2026-10-13T14:08:58.343Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "153.5", "lessThanOrEqual": "153.*", "versionType": "rpm"}, {"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5."}]}], "title": "Race condition, use-after-free in the Graphics: Text component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073396"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"}], "credits": [{"lang": "en", "value": "Shu Takahashi of Velcore Consulting Inc."}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-13T12:29:32.427Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109765", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T14:08:55.001726Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T14:08:49.792Z"}}]}}