---
title: Firefox 158.0.1 fixes high-severity SVG bug CVE-2026-113399 and hard-codes the eMudhra intermediate block (CVE-2026-113470) | ctxsec
url: https://ctxsec.com/items/firefox-158-0-1-mfsa2026-111
description: "Mozilla's MFSA 2026-111 fixes four CVEs in Firefox 158.0.1, including high-impact SVG boundary bug CVE-2026-113399 and CVE-2026-113470, which ships the OneCRL block of compromised eMudhra intermediates inside the build so it applies even where Remote Settings is disabled."
status: "confirmed (Mozilla MFSA 2026-111); no exploitation reported"
published: 2026-10-20
---

> Mozilla's MFSA 2026-111 fixes four CVEs in Firefox 158.0.1, including high-impact SVG boundary bug CVE-2026-113399 and CVE-2026-113470, which ships the OneCRL block of compromised eMudhra intermediates inside the build so it applies even where Remote Settings is disabled.

[← Cybersecurity News](/news) · [markdown](/items/firefox-158-0-1-mfsa2026-111.md)

confirmed (Mozilla MFSA 2026-111); no exploitation reported

2026-10-20

### Firefox 158.0.1 fixes high-severity SVG bug CVE-2026-113399 and hard-codes the eMudhra intermediate block (CVE-2026-113470)

Mozilla's [advisory MFSA 2026-111](https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/) (Oct 20) lists four fixes in Firefox 158.0.1: **CVE-2026-113399** (incorrect boundary conditions in SVG, high), **CVE-2026-113470** (high), CVE-2026-113400 (uninitialized memory in cubeb audio/video, moderate) and CVE-2026-113401 (PDF viewer DoS, low). No exploitation is reported.

CVE-2026-113470 is the follow-up to the eMudhra weak-key intermediates: Mozilla pushed the OneCRL block via Remote Settings on Oct 17, and this [release](https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/) bakes the block list into the browser so it holds even when Remote Settings is disabled by policy or unreachable. That matters for locked-down enterprise fleets that turn Remote Settings off.

**Do now:** push Firefox 158.0.1 (and Thunderbird 158.0.1, which per the CVE record also carries the SVG fix), prioritising managed fleets with Remote Settings disabled.

Sources: [Mozilla MFSA 2026-111](https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/) · [Firefox 158.0.1 release notes](https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/)