CVE-2026-16377

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

A vulnerability in the PDF Viewer component in Firefox and Thunderbird allows bypassing security mitigations. This was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

An attacker could exploit this vulnerability to bypass PDF viewer security measures, potentially leading to malicious code execution or data leakage when viewing PDF files.

Recommendation

Update Firefox to version 153 or later, Firefox ESR to 140.13 or later, and Thunderbird to version 153 or 140.13 depending on the branch used.

Original NVD description (English source)

Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.