← Back

CVE-2026-92009

nvd nist
Published: Sep 15, 2026Modified: Oct 6, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Affected (7)

Mozilla
2 products
Firefox
Thunderbird
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Mozilla
Firefox
version < 115.41.0
Firefox
116.0 ≤ version < 140.16.0
Firefox
141.0 ≤ version < 153.3.0
Firefox
154.0.0 ≤ version < 156.0.0
Mozilla
Thunderbird
version < 140.16.0
Thunderbird
141.0 ≤ version < 153.3.0
Thunderbird
154.0 ≤ version < 156.0

Related CWEs

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (8)

Source: security@mozilla.org
Permissions Required
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory

Timeline

No history available yet.