Invalid pointer in the JavaScript: WebAssembly component (Mozilla Firefox)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.32 % · percentile 25 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mozilla
- NVD status
- Modified
Description
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.
Weaknesses (CWE)
- CWE-763 — Release of Invalid Pointer or Reference
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-43662
- GCVE · GCVE-0-2026-15718
CERT-FR advisories
- CERTFR-2026-AVI-0913 — Multiples vulnérabilités dans Mozilla Thunderbird · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0910 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0887 — Multiples vulnérabilités dans Mozilla Firefox · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 152.0.6
Affected products
| Product | Versions |
|---|---|
| Mozilla · Firefox | unaffected 140.13 ≤ 140.* ; unaffected 152.0.6 ≤ * |
| Mozilla · Thunderbird | unaffected 140.13 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |