Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat Enterprise Linux 10 2026-09-21T00:00:00Z RHSA-2026:69461 firefox-0:140.16.0-1.el10_2 Red Hat Enterprise Linux 9 2026-09-21T00:00:00Z RHSA-2026:69462 firefox-0:140.16.0-1.el9_8 Red Hat Enterprise Linux 10 Affected rhel10/firefox-flatpak Red Hat Enterprise Linux 10 Affected rhel10/thunderbird-flatpak Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 6 Out of support scope firefox Red Hat Enterprise Linux 6 Out of support scope thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 7 Out of support scope thunderbird Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected thunderbird https://www.cve.org/CVERecord?id=CVE-2026-92023 https://nvd.nist.gov/vuln/detail/CVE-2026-92023 https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92023 https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92023