Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0848d84b80 advisory.

    - Updated to latest upstream (158.0.1)

    ----

    - Updated to latest upstream (157.0.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and     Thunderbird 158.0.1. (CVE-2026-113401)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary     Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the     prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a     potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary     Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the     prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a     potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
371934	Fedora 45 : firefox (2026-0848d84b80)	Nessus	Fedora Local Security Checks	Local	critical
371279	Linux Distros Unpatched Vulnerability : CVE-2026-113401	Nessus	Misc.	Local	medium
369077	Mozilla Thunderbird < 158.0.1	Nessus	Windows	Local	critical
369076	Mozilla Thunderbird < 158.0.1	Nessus	MacOS X Local Security Checks	Local	critical
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	Local	critical
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2026-113401

medium

Tenable Plugins

critical

medium

critical

critical

critical

critical