Firefox PDF Viewer CVE-2026-113401

Exploitation requires the victim to open or render an attacker-crafted PDF document within Firefox's built-in PDF Viewer (pdf.js) component - this user interaction (UI:R in the CVSS vector) is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and delivery is remote over the network (e.g., a web page or email attachment). The vulnerability affects Firefox versions prior to 158.0.1; installing 158.0.1 or later removes exposure. Impact is limited to availability (browser crash/hang) with no confidentiality or integrity consequences, and the scope is unchanged (S:U), confining the effect to the browser process.

This is a moderate-severity denial-of-service issue, consistent with its CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The vector indicates a network-delivered attack requiring no privileges but DOES require user interaction (UI:R) - i.e., a victim must open or render a malicious PDF in Firefox's built-in PDF Viewer. Impact is availability-only (A:H, with C:N/I:N), aligning with CWE-400 (uncontrolled resource consumption) and the 'Denial Of Service' tag; there is no code execution, data disclosure, or integrity loss. Exploitation status: no public exploit identified at time of analysis - the CVE is NOT in CISA KEV and no POC is referenced in the provided sources. No EPSS score was supplied, so exploitation probability cannot be quantified from this data and must be treated as UNKNOWN rather than low. No SSVC decision data was provided. On balance this is a real but lower-priority issue: a browser crash/hang (not RCE) that is gated behind user interaction, in an already-patched product (Firefox 158.0.1). It merits routine patch prioritization rather than emergency response, with the caveat that Firefox's ubiquity raises aggregate exposure.

An attacker hosts or emails a specially crafted PDF that triggers uncontrolled resource consumption in Firefox's built-in PDF Viewer. When the victim opens the PDF in Firefox (the required user interaction), the viewer exhausts memory or CPU, crashing or hanging the browser tab/process. No public proof-of-concept exploit is identified in the provided sources.