CVE-2026-16377 json
Mitigation bypass in the PDF Viewer component
published 2026-07-21 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-46213
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Patch / fix
- mozilla firefox 140.13.0, 153.0.0
- mozilla thunderbird 140.13.0, 153.0
- firefox-esr Debian 12 140.13.0esr-1~deb12u1
- firefox-esr Debian 13 140.13.0esr-1~deb13u1
- firefox-esr Debian 14 140.13.0esr-1
- thunderbird Debian 12 1:140.13.0esr-2~deb12u1
- thunderbird Debian 13 1:140.13.0esr-2~deb13u1
- thunderbird Debian 14 1:140.13.0esr-1
debian advisories DEBIAN-CVE-2026-16377
- thunderbird RHEL 8 140.13.0-1.el8_10
- thunderbird RHEL 9 140.13.0-1.el9_8
- thunderbird RHEL 10.2 140.13.0-1.el10_2
- firefox RHEL 9 140.13.0-1.el9_8
- firefox-x11 RHEL 9 140.13.0-1.el9_8
- firefox RHEL 8 140.13.0-1.el8_10
- firefox RHEL 10.2 140.13.0-1.el10_2
- firefox RHEL 8.8 TUS, RHEL 8.8 E4S 140.13.0-1.el8_8
red hat advisories RHSA-2026:54339RHSA-2026:54259RHSA-2026:54249RHSA-2026:54248RHSA-2026:54185RHSA-2026:54182
- MozillaThunderbird SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 153.2.0-150400.13.3.1
- mozilla-nss SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 3.125-150400.3.74.1
- mozilla-nspr SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 4.39-150400.12.3.1
- MozillaFirefox SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153.2.0-150400.157.5.1
- MozillaFirefox-branding-SLE SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153-150400.14.3.1
- mozilla-nss SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.125-160000.1.1
- mozilla-nspr SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.39-160000.1.1
- rust-cbindgen SLES for SAP applications 16.0, SLES 16.0 0.29.4+git0-160000.1.1
suse advisories SUSE-SU-2026:4268-1SUSE-SU-2026:4156-1SUSE-SU-2026:4140-1SUSE-SU-2026:23411-1SUSE-SU-2026:23590-1SUSE-SU-2026:3546-1
- rust-cbindgen openSUSE Leap 16.0 0.29.4+git0-160000.1.1
- mozilla-nss openSUSE Leap 16.0 3.125-160000.1.1
- mozilla-nspr openSUSE Leap 16.0 4.39-160000.1.1
- MozillaFirefox openSUSE Leap 16.0 153.1.0-160000.1.2
- MozillaFirefox openSUSE Leap 16.0 140.13.0-160000.1.1
- MozillaFirefox openSUSE Tumbleweed 153.0-1.1
- MozillaThunderbird openSUSE Tumbleweed 140.13.0-1.1
- firefox-esr openSUSE Tumbleweed 140.13.0-1.1
opensuse advisories openSUSE-SU-2026:21713-1openSUSE-SU-2026:21519-1openSUSE-SU-2026:11358-1openSUSE-SU-2026:11359-1openSUSE-SU-2026:11329-1
- thunderbird AlmaLinux 9 140.13.0-1.el9_8.alma.1
- thunderbird AlmaLinux 8 140.13.0-1.el8_10.alma.1
- thunderbird AlmaLinux 10 140.13.0-1.el10_2.alma.1
- firefox AlmaLinux 10 140.13.0-1.el10_2
- firefox AlmaLinux 9 140.13.0-1.el9_8.alma.1
- firefox-x11 AlmaLinux 9 140.13.0-1.el9_8.alma.1
- firefox AlmaLinux 8 140.13.0-1.el8_10.alma.1
almalinux advisories ALSA-2026:49921ALSA-2026:49922ALSA-2026:49621ALSA-2026:47101ALSA-2026:47104ALSA-2026:47105
- thunderbird Rocky Linux 10 140.13.0-1.el10_2
- thunderbird Rocky Linux 9 140.13.0-1.el9_8
- thunderbird Rocky Linux 8 140.13.0-1.el8_10
- firefox Rocky Linux 9 140.13.0-1.el9_8
- firefox Rocky Linux 10 140.13.0-1.el10_2
- firefox Rocky Linux 8 140.13.0-1.el8_10
rocky linux advisories RLSA-2026:49621RLSA-2026:49921RLSA-2026:49922RLSA-2026:47104RLSA-2026:47101RLSA-2026:47105
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-16377 updated cvss 6.1
firefox: thunderbird: Mitigation bypass in the PDF Viewer component
-
Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbirdaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 10 rhel10/firefox-flatpak, rhel10/thunderbird-flatpakaffected: no fix available
-
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.13.0-1.el8_10, thunderbird 140.13.0-1.el8_10fixed: vendor fix RHSA-2026:47105
-
Red Hat Enterprise Linux AppStream (v. 9) firefox 140.13.0-1.el9_8, firefox-x11 140.13.0-1.el9_8, thunderbird 140.13.0-1.el9_8fixed: vendor fix RHSA-2026:47104
-
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.13.0-1.el10_2, thunderbird 140.13.0-1.el10_2fixed: vendor fix RHSA-2026:47101
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.13.0-1.el8_4, thunderbird 140.13.0-1.el8_4fixed: vendor fix RHSA-2026:54180
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.13.0-1.el8_6, thunderbird 140.13.0-1.el8_6fixed: vendor fix RHSA-2026:54259
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.13.0-1.el8_8, thunderbird 140.13.0-1.el8_8fixed: vendor fix RHSA-2026:54339
show 8 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.13.0-1.el9_2, firefox-x11 140.13.0-1.el9_2, thunderbird 140.13.0-1.el9_2fixed: vendor fix RHSA-2026:54185
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) firefox 140.13.0-1.el9_4, firefox-x11 140.13.0-1.el9_4, thunderbird 140.13.0-1.el9_4fixed: vendor fix RHSA-2026:54182
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.13.0-1.el10_0, thunderbird 140.13.0-1.el10_0fixed: vendor fix RHSA-2026:54181
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.13.0-1.el9_6, firefox-x11 140.13.0-1.el9_6, thunderbird 140.13.0-1.el9_6fixed: vendor fix RHSA-2026:54249
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.13.0-1.el8_4, thunderbird 140.13.0-1.el8_4fixed: vendor fix RHSA-2026:54180
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) firefox 140.13.0-1.el8_6, thunderbird 140.13.0-1.el8_6fixed: vendor fix RHSA-2026:54259
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.13.0-1.el8_8, thunderbird 140.13.0-1.el8_8fixed: vendor fix RHSA-2026:54339
-
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.13.0-1.el7_9fixed: vendor fix RHSA-2026:54248
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 3 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Mozilla Firefox
- Mozilla Thunderbird
Classification
- Weakness
-
- CWE-693 Protection Mechanism Failure
References
-
mozilla.org
/security/advisories/mfsa2026-68/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2026-70/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2026-71/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2026-72/
vendor-advisory
-
bugzilla.mozilla.org
/show_bug.cgi?id=2037770
permissions-required
Sources
- CVE List CVE-2026-16377
- NVD CVE-2026-16377
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.