# Firefox for Windows Layout Out-of-Bounds Vulnerability (CVE-2026-120572) Fixed in 159.0.1

> Mozilla Firefox versions prior to 159.0.1 contain a memory-safety flaw (incorrect boundary conditions) in the Layout: Block and Inline component, tracked as CVE-2026-120572 and rated High by Mozilla (MFSA 2026-123). A remote attacker could entice a user to open a web page with specially crafted content; HK GovCERT reports denial of service as the impact, and the CVSS 3.1 vector (8.8) also rates confidentiality and integrity impact High. No exploitation in the wild is stated in any source.

- **Published:** 2026-11-06T20:13:27Z
- **Last reviewed:** 2026-11-06T20:13:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5443
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5443.png
- **ID:** TL-2026-5443
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (1 shown free below)
- **CVEs:** CVE-2026-120572

## Description

Mozilla Foundation Security Advisory 2026-123, announced 2026-11-03, fixes CVE-2026-120572 in Firefox 159.0.1. The flaw is described as "incorrect boundary conditions in the Layout: Block and Inline component" and is tracked in Mozilla Bug 2079035, which is restricted and not publicly readable at the time of research. Mozilla credits itself as the reporter, and Mozilla rates the impact High.

HK GovCERT Security Alert A26-11-06 (published 2026-11-04) lists the affected product as Firefox for Windows prior to 159.0.1. It states that a remote attacker could entice a user to open a web page with specially crafted content, and that successful exploitation could cause denial of service on the affected system. The recommended action is to upgrade to Firefox 159.0.1.

The CVE record enrichment (OpenCVE, citing CISA ADP Vulnrichment) lists CVSS 3.1 base score 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with weaknesses CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-193 (off-by-one error). The NVD record was still 'Awaiting Analysis' when checked. EPSS was 0.00329 (under 1%), and OpenCVE showed no CISA KEV listing. The vector's High C/I/A ratings indicate that memory corruption beyond a crash is possible in principle, but no source documents a working exploit, a public proof-of-concept, in-the-wild exploitation, a threat actor, or any network or file indicators. The bug details are restricted, so exploit mechanics are not publicly documented.

This record should be treated as patch-prioritization intelligence rather than active-threat intelligence. The vulnerable component, Layout: Block and Inline, processes untrusted web content, so the attack surface is any page the browser renders; user interaction (visiting or opening a crafted page) is required and no privileges are needed.

## MITRE ATT&CK

- T1204.001 User Execution: Malicious Link
- T1203 Exploitation for Client Execution
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vulnerable Firefox Build (< 159.0.1) Launched on Windows - CVE-2026-120572** (`TL-2026-5443-SPL-001`)

Identifies firefox.exe process launches whose file version is earlier than 159.0.1, the build that fixes CVE-2026-120572 (MFSA 2026-123, Layout: Block and Inline incorrect boundary conditions, CWE-119/CWE-193). The flaw is reachable by rendering crafted web content (T1189/T1203). No exploitation in the wild is reported, so this is a patch-prioritization detection: it tells defenders which hosts are running an exposed build.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1189
- **Data sources:** sysmon:EventCode=1, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, sigma:process_creation/windows
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\firefox.exe" earliest=-24h ```CVE-2026-120572 / MFSA 2026-123 - Firefox below 159.0.1 on Windows``` | rex field=FileVersion "^(?<ff_major>\d+)\.(?<ff_minor>\d+)(?:\.(?<ff_patch>\d+))?" | where isnotnull(ff_major) | eval ff_major=tonumber(ff_major), ff_minor=tonumber(ff_minor), ff_patch=coalesce(tonumber(ff_patch),0) | where ff_major<159 OR (ff_major=159 AND ff_minor=0 AND ff_patch<1) | stats count AS launches min(_time) AS first_seen max(_time) AS last_seen values(FileVersion) AS firefox_version BY Computer, User | convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "firefox.exe"
| extend FirefoxVersion = parse_version(ProcessVersionInfoProductVersion)
| where isnotnull(FirefoxVersion) and FirefoxVersion < parse_version("159.0.1")
| summarize Launches = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Versions = make_set(ProcessVersionInfoProductVersion, 5) by DeviceName, AccountName
| project DeviceName, AccountName, Versions, Launches, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Vulnerable Firefox Build Below 159.0.1 Launched on Windows - CVE-2026-120572
id: a3f1c2d4-5b6e-4f70-8a91-0c2d3e4f5a61
status: experimental
description: Detects firefox.exe launches whose FileVersion is earlier than 159.0.1, the release fixing CVE-2026-120572 (MFSA 2026-123, Layout Block and Inline out-of-bounds). Patch-prioritization content; no in-the-wild exploitation is reported.
references:
  - https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/
  - https://www.govcert.gov.hk/en/alerts_detail.php?id=2161
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial-access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - cve.2026.120572
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\firefox.exe'
  selection_version:
    FileVersion|re: '^(?:[0-9]{1,2}|1[0-4][0-9]|15[0-8])\.[0-9.]+$|^159\.0(?:\.0)*$'
  condition: selection_image and selection_version
falsepositives:
  - Firefox ESR builds, whose version numbers are lower than 159 but are not named in MFSA 2026-123
  - Intentionally pinned legacy browsers in isolated lab or kiosk environments
level: medium
```

**Known false positives:**

- Firefox ESR installations report version numbers below 159 but are not listed as affected in MFSA 2026-123; confirm against the advisory before treating as vulnerable
- Portable or lab Firefox copies that are intentionally pinned to older builds

**Tuning notes:** Sysmon FileVersion is empty on some builds; fall back to a software inventory feed (DeviceTvmSoftwareVulnerabilities where CveId == CVE-2026-120572) to cover hosts where the process-level version is missing. Exclude confirmed ESR hosts via a lookup. Run as a daily report rather than a real-time alert, and retire once the fleet is on 159.0.1 or later.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Repeated [indicator] Crashes on One Host - Possible CVE-2026-120572 Exploit Attempts (locked: unlock with TL Creds)
- [indicator] Writing Executable or Script Content Outside Download and Profile Paths (locked: unlock with TL Creds)
- Vulnerable [indicator] Opened from Mail or Office Link (locked: unlock with TL Creds)
- [indicator] Spawning Living-off-the-Land Binary (locked: unlock with TL Creds)
- [indicator] Writing Run or RunOnce Registry Persistence (locked: unlock with TL Creds)
- [indicator] Loading Unsigned DLL from Temp or Public Directory (locked: unlock with TL Creds)
- [indicator] Crash Reporter Launched - Possible CVE-2026-120572 Denial of Service (locked: unlock with TL Creds)
- [indicator] Spawning Command Interpreter - Possible Browser Exploitation Follow-On (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 9)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]govcert[.]gov[.]hk/en/alerts_detail.php?id=2161`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Security Alert (A26-11-06): Vulnerability in FireFox](https://www.govcert.gov.hk/en/alerts_detail.php?id=2161)
- [Mozilla Foundation Security Advisory mfsa2026-123: Security Vulnerabilities fixed in Firefox 159.0.1](https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/)
- [Mozilla Bug 2079035 (restricted)](https://bugzilla.mozilla.org/show_bug.cgi?id=2079035)
- [NVD: CVE-2026-120572](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120572)
- [OpenCVE: CVE-2026-120572 (CVSS, CWE, EPSS, KEV status)](https://app.opencve.io/cve/CVE-2026-120572)
- [MITRE CVE record: CVE-2026-120572](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-120572)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5443