Mozjs52: [Unknown description] (CVE-2026-84138)

CVE-2026-84138 is a denial-of-service vulnerability affecting the PDF Viewer component in Firefox, discovered internally and fixed in Firefox 155. The vulnerability is part of a broader set of security-relevant bugs found in Firefox 154, some involving memory corruption. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial-of-service). The vulnerability affects multiple specific mozjs52 package versions distributed in Ubuntu 18.04, 20.04, 22.04, and 24.04 LTS releases. The Mozilla Foundation Security Advisory 2026-82 lists this issue among others fixed in Firefox 155. No active exploitation is known.

The vulnerability allows an unauthenticated attacker to cause a denial-of-service condition in the PDF Viewer component of Firefox, impacting availability. There is no impact on confidentiality or integrity. The CVSS score of 7.5 reflects a medium severity due to the denial-of-service impact and ease of exploitation over the network without privileges or user interaction. No known exploits in the wild have been reported.

This vulnerability is fixed in Firefox 155. Users and administrators should upgrade to Firefox 155 or later to remediate this issue. The vendor advisory does not indicate any required temporary mitigations or workarounds. Patch status is confirmed by the Mozilla Foundation Security Advisory 2026-82.