CriticalCVE-2026-100788

    firefox: Access of Uninitialized Pointer (CVE-2026-100788)

    Published Sources: BSI

    What is affected, what to do

    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component

    Update Mozilla Firefox to version 140.17.0, Mozilla Firefox to version 153.4.0, Mozilla Firefox to version 157.0.0.

    Affected
    • Mozilla Firefox lt *..140.17.0
    • Mozilla Firefox lt 141.0..153.4.0
    • Mozilla Firefox lt 154.0.0..157.0.0
    • Mozilla Thunderbird lt *..140.17.0
    • Mozilla Thunderbird lt 141.0..153.4.0
    • Mozilla Thunderbird lt 154.0..157.0
    Fixed in
    • Mozilla Firefox 140.17.0
    • Mozilla Firefox 153.4.0
    • Mozilla Firefox 157.0.0
    • Mozilla Thunderbird 140.17.0
    • Mozilla Thunderbird 153.4.0
    • Mozilla Thunderbird 157.0

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: Vendor (CNA), CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: BSI

    0.4 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 35.6

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    77.43 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    0.4 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    35.6
    Elevated — this CVE ranks above at least 10% of all CVEs scored today.
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published
    CISA assessment (SSVC)
    Exploitation: none known · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 1 October 2026
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-824

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    mozillafirefox
    • 115.0 – < 115.42.0
    • 115.0.1 – < 115.42.0
    • 115.1.0 – < 115.42.0
    • 116.0 – < 140.17.0
    • 116.0.0 – < 140.17.0
    • 140.0 – < 140.17.0
    • 140.0.0 – < 140.17.0
    • 141.0 – < 153.4.0
    • 141.0.0 – < 153.4.0
    • 153.0 – < 153.4.0
    • 153.0.0 – < 153.4.0
    • 154.0.0 – < 157.0.0
    • < 115.42.0
    • < 140.17.0
    • < 153.4.0
    • < 157.0.0
    • 115.42.0
    • 115.42.0
    • 115.42.0
    • 140.17.0
    • 140.17.0
    • 140.17.0
    • 140.17.0
    • 153.4.0
    • 153.4.0
    • 153.4.0
    • 153.4.0
    • 157.0.0
    • 115.42.0
    • 140.17.0
    • 153.4.0
    • 157.0.0
    mozillafirefox_mobile
    • < 157.0
    • 157.0
    mozillathunderbird
    • 140.0 – < 140.17.0
    • 141.0 – < 153.4.0
    • 153.0 – < 153.4.0
    • 154.0 – < 157.0
    • < 140.17.0
    • < 153.4.0
    • < 157.0
    • 140.17.0
    • 153.4.0
    • 153.4.0
    • 157.0
    • 140.17.0
    • 153.4.0
    • 157.0
    MozillaFirefox
    • < 157
    • 157
    MozillaFirefox ESR
    • < 115.42
    • < 140.17
    • < 153.4
    • 115.42
    • 140.17
    • 153.4
    From bundled advisories, not CVE-specific (5)

    Product list of a bundled advisory that does not state which product this CVE affects.

    Products from bundled advisories
    Affected versionsFixed in
    MozillaFirefox
    • < 159
    • 159
    MozillaFirefox ESR
    • < 115.44
    • < 153.6
    • 115.44
    • 153.6
    MozillaThunderbird
    • < 153.6
    • < 159
    • 153.6
    • 159

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebianfirefox-esrbookworm
    Linuxdebianfirefox-esrtrixie
    Linuxdebianthunderbirdbookworm
    Linuxdebianthunderbirdtrixie

    Weakness classes (CWE)

    • CWE-824Access of Uninitialized Pointer

      Base

      The product accesses or uses a pointer that has not been initialized.

      Entry at MITRE CWE-824

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Initial analysis by NVDNVD

      Newly listed as affected:
      • Mozilla Firefox (154.0.0 – before 157.0.0; 141.0 – before 153.4.0; before 140.17.0)
      • Mozilla Thunderbird (154.0 – before 157.0; before 140.17.0; 141.0 – before 153.4.0)
      Show 8 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationadded
      —
      OR *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions from (including) 154.0.0 up to (excluding) 157.0.0 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions from (including) 154.0 up to (excluding) 157.0 *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions from (including) 141.0 up to (excluding) 153.4.0 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to (excluding) 140.17.0 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions from (including) 141.0 up to (excluding) 153.4.0 *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 140.17.0
      Reference typeadded
      —
      Mozilla Corporation: https://bugzilla.mozilla.org/show_bug.cgi?id=2072413 Types: Permissions Required
      Reference typeadded
      —
      Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-100/ Types: Vendor Advisory
      Reference typeadded
      —
      Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-101/ Types: Vendor Advisory
      Reference typeadded
      —
      Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-102/ Types: Vendor Advisory
      Reference typeadded
      —
      Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-103/ Types: Vendor Advisory
      Reference typeadded
      —
      Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-97/ Types: Vendor Advisory
      Reference typeadded
      —
      Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-99/ Types: Vendor Advisory

      Source identifier: nvd@nist.gov

    2. Record modifiedCISA ADP

      CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      CISA assessment (SSVC): exploitation: none known, automatable: yes

      Weakness type: CWE-824

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      CVSSadded
      —
      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
      Weakness type (CWE)added
      —
      CWE-824
      SSVC assessmentadded
      —
      {"id":"CVE-2026-100788","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:45:12.848467Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    3. Record modifiedMozilla

      Description added or changed

      Show 5 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionchanged
      Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
      Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
      Affected versions (publisher)added
      —
      Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/100xxx/CVE-2026-100788.json">CVE-2026-100788</a>
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-101/
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-102/
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-103/

      Source identifier: security@mozilla.org

    4. ReceivedMozilla

      Description added or changed

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionadded
      —
      Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
      Affected versions (publisher)added
      —
      New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/100xxx/CVE-2026-100788.json">CVE-2026-100788</a>
      Referenceadded
      —
      https://bugzilla.mozilla.org/show_bug.cgi?id=2072413
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-100/
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-97/
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-99/

      Source identifier: security@mozilla.org

    Linked CVEs

    Linked CVEs
    MediumCVE-2026-96869Information disclosure in the Networking component4.3—
    HighCVE-2026-100832Use-after-free in the Graphics: Canvas2D component8.8—
    HighCVE-2026-100831Use-after-free in the DOM: UI Events & Focus Handling component8.8—
    HighCVE-2026-100830Mitigation bypass in the DOM: Navigation component8.1—
    CriticalCVE-2026-100829Mitigation bypass in the DOM: Security component9.6—
    CriticalCVE-2026-100828Mitigation bypass in the Bookmarks & History component9.6—
    MediumCVE-2026-100826Denial-of-service in the Storage: StorageManager component6.5—
    HighCVE-2026-100825Use-after-free in the JavaScript Engine: JIT component8.8—
    HighCVE-2026-100824Privilege escalation in the Places component8.8—
    MediumCVE-2026-100823Spoofing issue in the Downloads component in Firefox for Android5.4—
    MediumCVE-2026-100822Spoofing issue in the Networking: HTTP component5.4—
    MediumCVE-2026-100821Site isolation issue in the Panning and Zooming component4.7—
    HighCVE-2026-100820Privilege escalation in the Address Bar component8.8—
    CriticalCVE-2026-100819Sandbox escape due to incorrect boundary conditions in the XPCOM component9.6—
    CriticalCVE-2026-100818Sandbox escape due to use-after-free in the Widget: Gtk component9.6—
    MediumCVE-2026-100817Other issue in the JavaScript: WebAssembly component5.4—
    HighCVE-2026-100816Site isolation issue in the DOM: Networking component8.1—
    HighCVE-2026-100815Use-after-free in the CSS Parsing and Computation component8.8—
    HighCVE-2026-100814Incorrect boundary conditions in the JavaScript Engine: JIT component8.8—
    HighCVE-2026-100813Invalid pointer in the JavaScript Engine: JIT component8.8—
    MediumCVE-2026-100812Denial-of-service in the Graphics component6.5—
    CriticalCVE-2026-100811Sandbox escape due to use-after-free in the DOM: Core & HTML component9.6—
    CriticalCVE-2026-100810Other issue in the DevTools component9.8—
    HighCVE-2026-100809Same-origin policy bypass in the DevTools component8.1—
    Show 53 more CVEs
    Linked CVEs
    HighCVE-2026-100808Mitigation bypass in the DOM: Service Workers component8.8—
    HighCVE-2026-100807Privilege escalation in the DOM: Service Workers component8.8—
    MediumCVE-2026-100806Uninitialized memory in the Graphics: WebGPU component4.3—
    HighCVE-2026-100805Race condition, use-after-free in the Audio/Video component7.5—
    CriticalCVE-2026-100804Sandbox escape due to use-after-free in the Preferences: Backend component9.6—
    HighCVE-2026-100803Same-origin policy bypass in the WebExtensions component8.1—
    MediumCVE-2026-100802Uninitialized memory in the Graphics: WebGPU component4.3—
    HighCVE-2026-100801Privilege escalation in the DLL Services component8.8—
    CriticalCVE-2026-100800Sandbox escape due to use-after-free in the Disability Access APIs component9.6—
    MediumCVE-2026-100799Uninitialized memory in the Graphics: WebGPU component4.3—
    HighCVE-2026-100798Cryptography misuse in Storage: Quota Manager component8.1—
    HighCVE-2026-100797Privilege escalation due to use-after-free in the Graphics: WebRender component8.8—
    HighCVE-2026-100796Use-after-free in the JavaScript: WebAssembly component8.8—
    MediumCVE-2026-100795Denial-of-service in the Networking component6.5—
    CriticalCVE-2026-100794Sandbox escape due to incorrect boundary conditions in the Internationalization component9.6—
    MediumCVE-2026-100793JIT miscompilation in the JavaScript Engine component6.5—
    HighCVE-2026-100792JIT miscompilation in the JavaScript: WebAssembly component7.1—
    HighCVE-2026-100791Use-after-free in the DOM: Core & HTML component8.8—
    HighCVE-2026-100790Use-after-free in the XSLT component8.8—
    HighCVE-2026-100789Use-after-free in the Graphics: Canvas2D component8.8—
    CriticalCVE-2026-100788Invalid pointer in the JavaScript: WebAssembly component9.8—
    CriticalCVE-2026-100787Sandbox escape in the XUL component9.6—
    CriticalCVE-2026-100786Sandbox escape due to use-after-free in the Graphics component9.6—
    HighCVE-2026-100785Use-after-free in the DOM: Core & HTML component8.8—
    HighCVE-2026-100784Use-after-free in the Layout: Text and Fonts component8.8—
    MediumCVE-2026-100783Uninitialized memory in the Audio/Video component4.3—
    HighCVE-2026-100782Privilege escalation due to incorrect boundary conditions in the Graphics component8.8—
    CriticalCVE-2026-100781Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component9.6—
    HighCVE-2026-100780Use-after-free in the DOM: Core & HTML component8.8—
    HighCVE-2026-100779Use-after-free in the XSLT component8.8—
    CriticalCVE-2026-100778Sandbox escape due to use-after-free in the DOM: Core & HTML component9.6—
    HighCVE-2026-100777Use-after-free in the Graphics: Canvas2D component8.8—
    HighCVE-2026-100776Use-after-free in the JavaScript: WebAssembly component8.8—
    CriticalCVE-2026-100775Sandbox escape in the Graphics component9.6—
    HighCVE-2026-100774Use-after-free in the DOM: Core & HTML component8.8—
    HighCVE-2026-100773Use-after-free in the Storage: IndexedDB component8.8—
    HighCVE-2026-100772Use-after-free in the DOM: Core & HTML component8.8—
    HighCVE-2026-100771Undefined behavior in the DOM: Streams component8.1—
    CriticalCVE-2026-100770Sandbox escape due to use-after-free in the DOM: Content Processes component9.6—
    HighCVE-2026-100769Use-after-free in the JavaScript: WebAssembly component8.8—
    HighCVE-2026-100768Use-after-free in the Graphics: WebGPU component8.8—
    HighCVE-2026-100767Use-after-free in the Networking: Cache component8.8—
    MediumCVE-2026-100766Information disclosure in the Networking: JAR component4.3—
    HighCVE-2026-100765Use-after-free in the JavaScript: WebAssembly component8.8—
    HighCVE-2026-100764Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component8.8—
    CriticalCVE-2026-100763Incorrect boundary conditions in the Graphics: WebGPU component9.1—
    CriticalCVE-2026-100762Sandbox escape due to use-after-free in the DOM: Content Processes component9.6—
    HighCVE-2026-100761Privilege escalation due to use-after-free in the Graphics: WebGPU component8.8—
    CriticalCVE-2026-100760Sandbox escape in the Security: Process Sandboxing component9.6—
    HighCVE-2026-100759Uninitialized memory in the Storage: Quota Manager component8.1—
    CriticalCVE-2026-100758Sandbox escape in the DOM: Navigation component9.6—
    HighCVE-2026-100757Use-after-free in the Widget component8.8—
    HighCVE-2026-100756Incorrect boundary conditions in the Audio/Video: Playback component8.1—
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-100788
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-100788"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-100788.svg?lang=en" alt="CVE-2026-100788 – NEOSEC Intel" height="20"></a>