CVE-2026-100771
Mozilla Firefox 115.0 – 115.42.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-100771 is a high-severity Reliance on Undefined, Unspecified, or Implementation-Defined Behavior (CWE-758) vulnerability in Mozilla Firefox. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-88923
Vulnerability Data
Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover reliance on undefined behavior through cross-platform or stress testing.
Mandating a documented development process and coding standards directly discourages dependence on unspecified behavior.
Engineering principles can require use of only well-defined language and API behaviors during development.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing, developer training) that reach a minority slice of undefined-behavior defects when those practices explicitly govern language-specific rules and vulnerability prevention; most instances arise from unspecified compiler/platform behaviors outside the clause's direct mandate.
Secure system architecture and engineering principles mandate use of well-specified interfaces and avoid undefined constructs.
Secure coding explicitly prohibits constructs whose behavior is undefined, unspecified or implementation-defined.
Security testing can detect some instances of undefined behavior but does not prevent the root weakness.