CVE-2026-92029 — Firefox — Fixed in 156 (+ other fixes)

High8.8 Published on Sep 15, 2026

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Fixed versions

Choose the version for your installed product and release branch.

Product	Fixed versions
Firefox	156
Firefox ESR	115.41 / 140.16 / 153.3
Thunderbird	156 / 140.16 / 153.3

Versions stated in the NVD description

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-416

Vendorsmozilla

Affected products

Vendors	Product	Versions
mozilla	firefox	< 115.41.0
mozilla	thunderbird	< 140.16.0

Vulnerabilities

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

Sep 21, 202617:43 6 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Fixed versions

Affected products

Related articles

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels