Every CVE Search/ Get API key

CVE-2026-118005

Use-after-free in the WebRTC: Signaling component

8.8 High

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.30%Up 0.1 points since Oct 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

Use-after-free in the WebRTC: Signaling component

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Record
CVE-2026-118005
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-05
EUVDEUVD-2026-110903 8.8

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Record
EUVD-2026-110903
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-x83p-4x4x-pqcv 8.8

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.

Record
GHSA-x83p-4x4x-pqcv
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-05
NVD 8.8

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Record
CVE-2026-118005
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-05
OSVUBUNTU-CVE-2026-118005 8.8

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Record
UBUNTU-CVE-2026-118005
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs102
Ubuntu:22.04:LTS
 All versions, plus listed versions
102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
mozjs91
Ubuntu:22.04:LTS
 All versions, plus listed versions
91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1
 None known
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
mozjs102
Ubuntu:24.04:LTS
 All versions, plus listed versions
102.15.1-1102.15.1-3ubuntu2
 None known
mozjs115
Ubuntu:24.04:LTS
 All versions, plus listed versions
115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4
Show 4 moreShow less
115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1
 None known

History

History
RecordedChangedSources
cwes, facts, severityCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-118005 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open