# CVE-2026-124870

Memory-corruption in Firefox/Thunderbird JS GC can enable remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2026-124870
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.39% (percentile 33.7)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-10)
- Weakness: CWE-120
- Published: 2026-11-10

## Affected

- Mozilla Firefox (fixed in 160)
- Firefox ESR (fixed in 153.7)
- Mozilla Thunderbird (fixed in 160)
- Thunderbird ESR (fixed in 153.7)

## Impact

Memory-bounds error in JS GC may allow remote code execution via crafted web content or messages.

## Action

Immediate action required

## Recommendation

Install Firefox 160 / ESR 153.7 and Thunderbird 160 / ESR 153.7 immediately.

## References

- [other] https://bugzilla.mozilla.org/show_bug.cgi?id=2079466
- [other] https://www.mozilla.org/security/advisories/mfsa2026-125/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-127/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-128/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-129/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.