--- id: CVE-2026-100788 title: 'Invalid pointer in the JavaScript: WebAssembly component' summary: >- Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-824 vendor: Mozilla product: Thunderbird affected: - Thunderbird - Firefox published: '2026-09-29' updated: '2026-10-01' sourceUpdated: '2026-10-01T15:17:18.727' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100788' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2072413' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-100/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-101/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-103/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-97/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100788.json - url: 'https://access.redhat.com/security/cve/CVE-2026-100788' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543174' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-100788' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100788' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100788' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100788' - url: 'https://access.redhat.com/errata/RHSA-2026:85240' - url: 'https://access.redhat.com/errata/RHSA-2026:76764' - url: 'https://access.redhat.com/errata/RHSA-2026:80674' - url: 'https://access.redhat.com/errata/RHSA-2026:76850' - url: 'https://access.redhat.com/errata/RHSA-2026:85243' - url: 'https://access.redhat.com/errata/RHSA-2026:85242' - url: 'https://access.redhat.com/errata/RHSA-2026:85241' - url: 'https://access.redhat.com/errata/RHSA-2026:85244' - url: 'https://access.redhat.com/errata/RHSA-2026:76761' - url: 'https://access.redhat.com/errata/RHSA-2026:80694' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute ssvc: exploitation: none automatable: 'yes' technicalImpact: total timestamp: '2026-10-01T14:45:12.848467Z' epss: 0.00415 epssPercentile: 0.35567 ingestedAt: '2026-09-29T13:34:31.665Z' scores: nvd: 9.8 vendor: 7.5 patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 --- ## Overview Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100788.json) - **RHSA-2026:85240** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85240) - **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764) - **RHSA-2026:80674** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80674) - **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850) - **RHSA-2026:85243** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85243) - **RHSA-2026:85242** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85242) - **RHSA-2026:85241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85241) - **RHSA-2026:85244** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85244) - **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761) - **RHSA-2026:80694** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80694)