Mozilla Firefox EUVD-2026-98644

Exploitation requires the victim to use Mozilla Firefox (desktop/ESR builds prior to Firefox 158, ESR 115.43, or ESR 153.5) and to load attacker-controlled content that causes the browser to parse and render a malicious SVG document in the vulnerable SVG component. The key limiting factor is mandatory user interaction (UI:R): the target must actively open or browse to the hostile page/content - the flaw cannot be triggered against an idle browser or server-side, and per SSVC it is not automatable for mass exploitation. No authentication is required (PR:N). Impact is bounded to partial confidentiality/integrity (memory information disclosure), not full code execution or denial of service, which further limits real-world severity.

This is a moderate-severity (CVSS 5.4) use-after-free (CWE-416) in Firefox's SVG rendering component. The signals are internally consistent and point to LIMITED real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes network-reachable, low-complexity, unauthenticated exploitation but REQUIRES user interaction (UI:R) - i.e., the victim must load attacker-controlled content - and yields only Low confidentiality and Low integrity impact with no availability impact. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-weaponized, consistent with the UI:R requirement), and Technical Impact=partial (matching the Low/Low/None CVSS impacts). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no proof-of-concept referenced, so this is not confirmed exploited. The tags 'Information Disclosure' and 'Memory Corruption' align with the C:L/I:L impact - the practical outcome is likely a memory-disclosure/info-leak primitive rather than reliable remote code execution, which is why impact is rated Low rather than High. Net assessment: a legitimate browser memory-safety bug worth patching on a normal cadence, but not a drop-everything emergency; all signals (SSVC none/no/partial, no KEV, no POC, UI required) agree.

An attacker hosts a web page or delivers content containing a maliciously crafted SVG document and lures a Firefox user into visiting it (UI:R). When Firefox parses and renders the SVG, the use-after-free is triggered, allowing the attacker to read freed/adjacent memory and leak sensitive in-process data (C:L/I:L). No public exploit code is referenced, so weaponization would require the attacker to independently develop a reliable trigger.