--- id: CVE-2026-92016 title: Use-after-free in the Disability Access APIs component summary: >- Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-416 - CWE-825 vendor: mozilla product: firefox affected: - firefox < 140.16.0 - 'firefox >= 141.0, < 153.3.0' - 'firefox >= 154.0.0, < 156.0.0' - thunderbird < 140.16.0 - 'thunderbird >= 141.0, < 153.3.0' - 'thunderbird >= 154.0, < 156.0' patched: - firefox 156.0.0 - thunderbird 156.0 published: '2026-09-15' updated: '2026-10-06' sourceUpdated: '2026-10-06T14:41:42.747' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92016' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2061327' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-90/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-92/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-93/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-94/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-95/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-96/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92016.json - url: 'https://access.redhat.com/security/cve/CVE-2026-92016' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2533764' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92016' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92016' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92016' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92016' - url: 'https://access.redhat.com/errata/RHSA-2026:69461' - url: 'https://access.redhat.com/errata/RHSA-2026:69462' - url: 'https://access.redhat.com/errata/RHSA-2026:70642' - url: 'https://access.redhat.com/errata/RHSA-2026:71652' - url: 'https://access.redhat.com/errata/RHSA-2026:73130' - url: 'https://access.redhat.com/errata/RHSA-2026:73971' - url: 'https://access.redhat.com/errata/RHSA-2026:82818' - url: 'https://access.redhat.com/errata/RHSA-2026:81392' - url: 'https://access.redhat.com/errata/RHSA-2026:82122' - url: 'https://access.redhat.com/errata/RHSA-2026:81913' - url: 'https://access.redhat.com/errata/RHSA-2026:82720' - url: 'https://access.redhat.com/errata/RHSA-2026:81912' - url: 'https://access.redhat.com/errata/RHSA-2026:82780' - url: 'https://access.redhat.com/errata/RHSA-2026:81394' - url: 'https://access.redhat.com/errata/RHSA-2026:81393' - url: 'https://access.redhat.com/errata/RHSA-2026:82817' - url: 'https://access.redhat.com/errata/RHSA-2026:81884' - url: 'https://access.redhat.com/errata/RHSA-2026:83496' - url: 'https://access.redhat.com/errata/RHSA-2026:82779' - url: 'https://access.redhat.com/errata/RHSA-2026:83076' - url: 'https://access.redhat.com/errata/RHSA-2026:83077' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00312 epssPercentile: 0.23925 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-09-20T00:33:09.895820Z' scores: nvd: 8.8 vendor: 7.5 adp: 8.8 ingestedAt: '2026-09-15T12:36:50.197Z' --- ## Overview Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. ## Affected - `firefox < 140.16.0` - `firefox >= 141.0, < 153.3.0` - `firefox >= 154.0.0, < 156.0.0` - `thunderbird < 140.16.0` - `thunderbird >= 141.0, < 153.3.0` - `thunderbird >= 154.0, < 156.0` ## Remediation Upgrade past the affected range: - `firefox 156.0.0` - `thunderbird 156.0` ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92016.json) - **RHSA-2026:69461** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69461) - **RHSA-2026:69462** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69462) - **RHSA-2026:70642** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:70642) - **RHSA-2026:71652** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71652) - **RHSA-2026:73130** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:73130) - **RHSA-2026:73971** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73971) - **RHSA-2026:82818** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:82818) - **RHSA-2026:81392** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:81392) - **RHSA-2026:82122** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82122) - **RHSA-2026:81913** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:81913) - **RHSA-2026:82720** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:82720) - **RHSA-2026:81912** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:81912) - **RHSA-2026:82780** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:82780) - **RHSA-2026:83496** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83496) - **RHSA-2026:82779** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:82779) - **RHSA-2026:83076** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83076)