CVE-2026-84138: Mozilla Firefox PDF Viewer DOS Vulnerability

CVE-2026-84138 Overview

CVE-2026-84138 is a denial-of-service vulnerability in the PDF Viewer component shipped with Mozilla Firefox and Mozilla Thunderbird. An attacker who convinces a user to open a crafted PDF document can trigger a resource-exhaustion condition that renders the application unresponsive. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. Mozilla resolved the issue in Firefox 155 and Thunderbird 155 through security advisories MFSA-2026-82 and MFSA-2026-86. Exploitation requires user interaction and delivers no confidentiality or integrity impact, but the availability impact on the client application is high.

Critical Impact
Successful exploitation causes Firefox or Thunderbird to become unresponsive when a crafted PDF is rendered, disrupting user workflows and requiring the application to be terminated.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Thunderbird versions prior to 155
Any downstream distribution embedding the vulnerable PDF Viewer component

Discovery Timeline

2026-09-01 - CVE-2026-84138 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84138

Vulnerability Analysis

The vulnerability resides in the built-in PDF Viewer used by both Firefox and Thunderbird. The component fails to properly bound resource consumption when parsing or rendering specific structures inside a crafted PDF document. Once the malformed document is processed, the viewer enters a state that exhausts CPU or memory resources available to the browser or mail client. The result is a denial-of-service condition affecting the application process. Additional detail is tracked in Mozilla Bug Report #2056164.

Root Cause

The root cause is uncontrolled resource consumption within the PDF Viewer parsing and rendering path, aligning with [CWE-400]. The component lacks sufficient safeguards on allocation size, iteration bounds, or object complexity when handling attacker-controlled PDF content. Mozilla addressed the issue in the Firefox 155 and Thunderbird 155 release cycles.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts or delivers a malicious PDF via a web page, direct link, or email attachment rendered inside Thunderbird. When the victim opens the document in the vulnerable PDF Viewer, the application consumes excessive resources and becomes unresponsive. No authentication is required, and no code execution or data disclosure has been reported for this issue.

No verified proof-of-concept code is publicly available. Refer to the vendor advisories for authoritative technical details.

Detection Methods for CVE-2026-84138

Indicators of Compromise

Firefox or Thunderbird processes consuming sustained high CPU or memory shortly after opening a PDF attachment or link
Application hangs, unresponsive tabs, or forced termination events tied to pdf.js rendering
Inbound email attachments or web downloads containing anomalously structured PDF documents

Detection Strategies

Correlate endpoint telemetry showing Firefox or Thunderbird resource spikes with recent PDF file open events
Inspect mail gateway logs for PDF attachments delivered to users running Firefox or Thunderbird versions below 155
Alert on repeated crashes or watchdog terminations of firefox.exe or thunderbird.exe processes

Monitoring Recommendations

Track browser and mail client version inventory to identify hosts running versions below 155
Monitor endpoint performance counters for abnormal memory allocation patterns by browser processes
Retain PDF attachments delivered before patching for retrospective analysis if user reports of hangs occur

How to Mitigate CVE-2026-84138

Immediate Actions Required

Upgrade Mozilla Firefox to version 155 or later across all managed endpoints
Upgrade Mozilla Thunderbird to version 155 or later, including any Extended Support Release channels that received the fix
Advise users to avoid opening PDF attachments from untrusted senders until patches are deployed

Patch Information

Mozilla released fixes in Firefox 155 and Thunderbird 155. Deployment details are documented in Mozilla Security Advisory MFSA-2026-82 and Mozilla Security Advisory MFSA-2026-86. Enterprises using managed update channels should validate that clients have received the updated builds.

Workarounds

Configure Firefox to open PDF files in an external, patched PDF reader instead of the built-in viewer
Configure Thunderbird to prompt before opening PDF attachments and route them to an isolated viewer
Apply mail gateway policies that quarantine PDF attachments from untrusted external senders pending patch deployment

bash

# Firefox: disable the built-in PDF Viewer as a temporary workaround
# In about:config set the following preference
pdfjs.disabled = true