CERT-FR relays Mozilla advisory for Firefox flaw CVE-2026-120572, fixed in Firefox 159.0.1
The CERT-FR bulletin CERTFR-2026-AVI-1455 relays Mozilla advisory mfsa2026-123 of 3 November 2026. It covers one vulnerability, CVE-2026-120572, in Mozilla Firefox versions before 159.0.1. CERT-FR says the flaw lets an attacker cause a "security issue not specified by the vendor". The bulletin does not mention exploitation. The same CERT-FR page carries a banner about a new notification campaign targeting Apple phones on 29 October 2026. That banner is unrelated to this Firefox flaw.
Entenda a falha
A vulnerabilidade
CVE-2026-120572 is a High-severity flaw in Mozilla Firefox, in the Layout: Block and Inline component. Mozilla titles it "Incorrect boundary conditions". Firefox versions before 159.0.1 are affected and 159.0.1 fixes it. The advisory gives no prerequisites, no CVSS vector and no description of what an attacker gains. CERT-FR only says it allows a "security issue not specified by the vendor".
Como funciona
The articles do not describe how the vulnerable process works. All that is known is that the bug sits in the part of the engine that lays out block and inline content, and that the problem involves boundary conditions. What input reaches that code and what goes wrong at which step has not been published.
Por que é vulnerável
Mozilla's title, "Incorrect boundary conditions", points to a boundary-related error in the layout code. The advisory gives no further technical detail on the root cause, on why it went unnoticed or on what the fix changes, so nothing more can be stated without guessing.
Onde está
The Layout: Block and Inline component of Firefox, tracked in Mozilla Bugzilla bug 2079035. No file or function is named.
Como foi descoberta
According to the advisory, the flaw was reported by Mozilla itself (Bugzilla bug 2079035). Mozilla published it in advisory mfsa2026-123 on 3 November 2026, and CERT-FR relayed it in bulletin CERTFR-2026-AVI-1455 on 4 November. Neither source mentions exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:22.
Detalhes técnicos
Mozilla's advisory titles the flaw "Incorrect boundary conditions in the Layout: Block and Inline component" and rates it High (mozilla.org). It was reported by Mozilla itself (Bugzilla bug 2079035) and gives no further technical detail (mozilla.org). The advisory does not state prerequisites and does not mention exploitation in the wild. It gives no CVSS vector.
Remediação
Update Firefox to 159.0.1 or later, as listed in Mozilla's advisory mfsa2026-123 (mozilla.org).
Linha do tempo
-
CERT-FR relays Mozilla advisory for Firefox flaw CVE-2026-120572, fixed in Firefox 159.0.1
ler a análise desta fonte ocultar
The CERT-FR bulletin CERTFR-2026-AVI-1455 relays Mozilla advisory mfsa2026-123 of 3 November 2026. It covers one vulnerability, CVE-2026-120572, in Mozilla Firefox versions before 159.0.1. CERT-FR says the flaw lets an attacker cause a "security issue not specified by the vendor". The bulletin does not mention exploitation. The same CERT-FR page carries a banner about a new notification campaign targeting Apple phones on 29 October 2026. That banner is unrelated to this Firefox flaw.
Technical Details
Mozilla's advisory titles the flaw "Incorrect boundary conditions in the Layout: Block and Inline component" and rates it High (mozilla.org). It was reported by Mozilla itself (Bugzilla bug 2079035) and gives no further technical detail (mozilla.org). The advisory does not state prerequisites and does not mention exploitation in the wild. It gives no CVSS vector.
Remediation
Update Firefox to 159.0.1 or later, as listed in Mozilla's advisory mfsa2026-123 (mozilla.org).