CVEvulnerability
CVE-2026-92032
9.6 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-15
- Last modified
- 2026-10-05
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-119
Description
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected configurations
• mozilla firefox (< 140.16.0)
• mozilla firefox (>= 141.0 < 153.3.0)
• mozilla firefox (>= 154.0.0 < 156.0.0)
• mozilla thunderbird (< 140.16.0)
• mozilla thunderbird (>= 141.0 < 153.3.0)
• mozilla thunderbird (>= 154.0 < 156.0)
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2068437 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-90/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-92/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-93/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-94/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-95/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-96/ Vendor Advisory