Mozilla Firefox and Thunderbird: Integer overflow in Graphics component
Summary
Mozilla Firefox (including ESR branches) and Thunderbird contain an integer overflow (CWE-190) in the Graphics component. A remote attacker can persuade a user to open a malicious web page or email content, which may lead to a crash or code execution with high impact on confidentiality, integrity and availability (CVSS 8.8). No user privileges are needed, but user interaction is required.
Affected
- Mozilla Firefox before 158
- Mozilla Firefox ESR 115 before 115.43
- Mozilla Firefox ESR 153 before 153.5
- Mozilla Thunderbird before 158
- Mozilla Thunderbird 153 before 153.5
- Exact per-branch version ranges were not fully verified against Mozilla's bug entry. Distribution packages may use different versions.
Fixed in
- Firefox 158
- Firefox ESR 115.43
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
Workaround
Unknown. No vendor-recommended workaround is available. Update to the fixed releases.
Exploitation
- Exploited in the wild: none known.
- Public proof of concept: none known.
- CISA SSVC assessment: exploitation none, not automatable.
- A third-party tracker lists the CVE as not in the CISA KEV catalogue. This was not checked directly.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird on all workstations to the fixed versions or later, with priority on systems with disabled or delayed automatic updates.
- Check managed update channels such as Windows software deployment and Linux repositories, and verify installed versions.
- Check Linux distribution advisories, since package versions differ from Mozilla's releases.
- Monitor for further Mozilla updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-107 (Firefox ESR 115.43) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Mozilla Bugzilla bug 2074896 bugzilla.mozilla.org
- Ubuntu security notice CVE-2026-109730 ubuntu.com
- HKCERT security bulletin on Mozilla products www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:13.
Original description (NVD)
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2074896
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.