CVE-2026-113399
CVE-2026-113399
- Critical
- CVSS 9.8
- EPSS 0.18%
- No fixed version listed
Summary
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
From the CVE record.
What to do
No fixed version listed
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by CISA-ADP)
- EPSS
- 0.18% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 29, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: yes. Technical impact: total. As of Oct 29, 2026.
- Weakness
- CWE-190: Integer Overflow or Wraparound
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.