Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

mozilla mfsa2026-129: Security Vulnerabilities fixed in Thunderbird 153.7

The version of Firefox ESR installed on the remote Windows host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-127 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR     153.7, and Thunderbird 160. (CVE-2026-124855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-125 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 160 and Thunderbird 160. (CVE-2026-124852)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.45. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-126 advisory.

  - Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160,     Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124903)

  - Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
    (CVE-2026-124952)

  - Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5,     Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.45. (CVE-2026-109736)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox     ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124857)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-127 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR     153.7, and Thunderbird 160. (CVE-2026-124855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.45. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-126 advisory.

  - Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160,     Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124903)

  - Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
    (CVE-2026-124952)

  - Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5,     Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.45. (CVE-2026-109736)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox     ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124857)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-125 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 160 and Thunderbird 160. (CVE-2026-124852)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR     115.45, and Firefox ESR 153.7. (CVE-2026-124885)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
378433	Mozilla Firefox ESR < 153.7	Nessus	Windows	Local	critical
378432	Mozilla Firefox < 160.0	Nessus	Windows	Local	critical
378431	Mozilla Firefox ESR < 115.45	Nessus	Windows	Local	critical
378430	Mozilla Firefox ESR < 153.7	Nessus	MacOS X Local Security Checks	Local	critical
378429	Mozilla Firefox ESR < 115.45	Nessus	MacOS X Local Security Checks	Local	critical
378428	Mozilla Thunderbird < 160.0	Nessus	MacOS X Local Security Checks	Local	critical
378427	Mozilla Thunderbird < 160.0	Nessus	Windows	Local	critical
378426	Mozilla Firefox < 160.0	Nessus	MacOS X Local Security Checks	Local	critical
378221	Linux Distros Unpatched Vulnerability : CVE-2026-124885	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-124885

high

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

high