Every CVE Search/ Get API key

CVE-2016-1522

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox...

8.8 HighFix available

CVE-2016-1522 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published February 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.31%, the 94th percentile. Fixed in graphite2 1.3.5-1.

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

8.31%Up 2.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
CVE-2016-1522
Updated
2026-11-02
EUVDEUVD-2016-2617 No score

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
EUVD-2016-2617
Updated
2026-11-03
GitHub AdvisoriesGHSA-g9c3-vp28-w6w3 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox...

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
GHSA-g9c3-vp28-w6w3
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-1522 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
DEBIAN-CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-1522 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
UBUNTU-CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0077 No score

Updated graphite2/firefox packages fix security vulnerability

Multiple vulnerabilities in the graphite2 font library can result in information disclosure, denial-of-service (application crashes), or code execution via out-of-bounds reads, a NULL pointer dereference, and a heap-based buffer overflow (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526).

Firefox includes a bundled copy of the graphite2 library, which has been updated in Firefox ESR 38.6.1.

Record
MGASA-2016-0077
Updated
2026-11-02
OSVMGASA-2016-0078 No score

Updated thunderbird packages fix security vulnerability

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2016-1930, CVE-2016-1935).

Multiple security flaws were found in the graphite2 font library bundled with Thunderbird. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526).

Thunderbird includes a bundled copy of the graphite2 library, which has been updated in Thunderbird 38.6.0.

Record
MGASA-2016-0078
Updated
2026-11-02
OSVUSN-2902-1 No score

graphite2 vulnerabilities

Yves Younan discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially- crafted font file, a remote attacker could use this issue to cause graphite2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-2902-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
graphite2
Debian:12
 before 1.3.5-1
1.3.5-1
graphite2
Debian:13
 before 1.3.5-1
1.3.5-1
graphite2
Debian:14
 before 1.3.5-1
1.3.5-1
graphite2
Debian:7
 before 1.3.5-1~deb7u1, plus listed versions
1.1.3-11.1.3-1+powerpcspe11.2.0-11.2.0-21.2.0-3
Show 22 moreShow less
1.2.0-41.2.1-11.2.1-21.2.1-2+powerpcspe11.2.2-11.2.2-1+alpha1.2.2-21.2.3-11.2.3-1+powerpcspe11.2.4-11.2.4-1+powerpcspe11.2.4-21.2.4-31.3.0-11.3.0-21.3.2-11.3.2-21.3.2-31.3.2-41.3.3-11.3.4-11.3.4-2
1.3.5-1~deb7u1
graphite2
Debian:8
 before 1.3.5-1~deb8u1, plus listed versions
1.2.4-31.3.0-11.3.0-21.3.2-11.3.2-2
Show 6 moreShow less
1.3.2-31.3.2-41.3.3-11.3.4-11.3.4-21.3.5-1~deb7u1
1.3.5-1~deb8u1
firefox
Mageia:5
 before 38.6.1-1.mga5
38.6.1-1.mga5
firefox-l10n
Mageia:5
 before 38.6.1-1.mga5
38.6.1-1.mga5
graphite2
Mageia:5
 before 1.3.5-1.mga5
1.3.5-1.mga5
thunderbird
Mageia:5
 before 38.6.0-1.mga5
38.6.0-1.mga5
thunderbird-l10n
Mageia:5
 before 38.6.0-1.mga5
38.6.0-1.mga5
Show 48 moreShow less
Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:5::client
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox
Red Hat:enterprise_linux:5::server
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox
Red Hat:enterprise_linux:6::client
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::computenode
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::server
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::workstation
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:7::client
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox
Red Hat:enterprise_linux:7::server
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox
Red Hat:enterprise_linux:7::workstation
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
thunderbird
Red Hat:enterprise_linux:5::client
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird
Red Hat:rhel_productivity:5
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird-debuginfo
Red Hat:rhel_productivity:5
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird
Red Hat:enterprise_linux:6::client
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird
Red Hat:enterprise_linux:6::server
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird
Red Hat:enterprise_linux:6::workstation
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird
Red Hat:enterprise_linux:7::client
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird
Red Hat:enterprise_linux:7::server
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird
Red Hat:enterprise_linux:7::workstation
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
graphite2
Red Hat:enterprise_linux:7::client
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::client
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::computenode
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::server
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::server
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::workstation
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Ubuntu:14.04:LTS
 before 1.2.4-1ubuntu1.1, plus listed versions
1.2.3-11.2.4-11.2.4-1ubuntu1
1.2.4-1ubuntu1.1
graphite2
Ubuntu:16.04:LTS
 before 1.3.5-1ubuntu1, plus listed versions
1.2.4-3ubuntu1
1.3.5-1ubuntu1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 73 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open