Every CVE Search/ Get API key

CVE-2016-1526

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in...

8.1 HighFix available

CVE-2016-1526 is a high vulnerability (CVSS 8.1) in Mozilla Firefox, published February 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 82nd percentile. Fixed in graphite2 1.3.5-1.

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

2.25%Down 1.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.1

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
CVE-2016-1526
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness
CWE-119, CWE-200
Updated
2026-11-02
CVE List No score

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
CVE-2016-1526
Updated
2026-11-02
EUVDEUVD-2016-2621 No score

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
EUVD-2016-2621
Updated
2026-11-03
GitHub AdvisoriesGHSA-44hj-fxxj-472x 8.1

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in...

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
GHSA-44hj-fxxj-472x
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 8.1

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
CVE-2016-1526
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-1526 8.1

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
DEBIAN-CVE-2016-1526
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-1526 8.1

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
UBUNTU-CVE-2016-1526
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2016-0077 No score

Updated graphite2/firefox packages fix security vulnerability

Multiple vulnerabilities in the graphite2 font library can result in information disclosure, denial-of-service (application crashes), or code execution via out-of-bounds reads, a NULL pointer dereference, and a heap-based buffer overflow (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526).

Firefox includes a bundled copy of the graphite2 library, which has been updated in Firefox ESR 38.6.1.

Record
MGASA-2016-0077
Updated
2026-11-02
OSVMGASA-2016-0078 No score

Updated thunderbird packages fix security vulnerability

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2016-1930, CVE-2016-1935).

Multiple security flaws were found in the graphite2 font library bundled with Thunderbird. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526).

Thunderbird includes a bundled copy of the graphite2 library, which has been updated in Thunderbird 38.6.0.

Record
MGASA-2016-0078
Updated
2026-11-02
OSVSUSE-SU-2016:0779-1 No score

Security update for graphite2

This update for graphite2 fixes the following issues:

  • CVE-2016-1521: The directrun function in directmachine.cpp in Libgraphite did not validate a certain skip operation, which allowed remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

  • CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in Libgraphite mishandled a return value, which allowed remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.

  • CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite incorrectly validated a size value, which allowed remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Record
SUSE-SU-2016:0779-1
Updated
2026-11-02
OSVUSN-2902-1 No score

graphite2 vulnerabilities

Yves Younan discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially- crafted font file, a remote attacker could use this issue to cause graphite2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-2902-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
graphite2
Debian:12
 before 1.3.5-1
1.3.5-1
graphite2
Debian:13
 before 1.3.5-1
1.3.5-1
graphite2
Debian:14
 before 1.3.5-1
1.3.5-1
iceweasel
Debian:7
 before 38.6.1esr-1~deb7u1, plus listed versions
10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1
Show 45 moreShow less
11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.10esr-1~deb7u117.0.5esr-117.0.6esr-117.0.6esr-1~deb7u117.0.7esr-117.0.7esr-1~deb7u117.0.7esr-217.0.8esr-117.0.8esr-1~deb7u117.0.8esr-217.0.8esr-2~deb7u117.0.9esr-1~deb7u118.0-118.0.1-118.0.2-1
38.6.1esr-1~deb7u1
iceweasel
Debian:8
 before 38.6.1esr-1~deb8u1, plus listed versions
31.6.0esr-131.7.0esr-1~deb7u131.7.0esr-1~deb8u131.8.0esr-1~deb7u131.8.0esr-1~deb8u1
Show 45 moreShow less
32.0-132.0.3-132.0~b1-132.0~b3-132.0~b5-133.0-133.0-233.1-134.0-135.0-135.0.1-136.0-136.0-236.0.1-136.0.1-236.0.4-137.0-137.0.1-137.0.2-138.0-138.0-238.0.1-138.0.1-238.0.1-338.0.1-438.0.1-538.1.0esr-138.1.0esr-238.1.0esr-338.1.1esr-138.1.1esr-1~deb9u138.2.0esr-138.2.0esr-1~deb7u138.2.0esr-1~deb8u138.2.0esr-1~stretch38.2.1esr-138.2.1esr-1~deb7u138.2.1esr-1~deb8u138.3.0esr-138.3.0esr-1~deb7u138.3.0esr-1~deb8u138.4.0esr-138.4.0esr-1~deb7u138.4.0esr-1~deb8u138.5.0esr-1
38.6.1esr-1~deb8u1
graphite2
Debian:7
 before 1.3.5-1~deb7u1, plus listed versions
1.1.3-11.1.3-1+powerpcspe11.2.0-11.2.0-21.2.0-3
Show 22 moreShow less
1.2.0-41.2.1-11.2.1-21.2.1-2+powerpcspe11.2.2-11.2.2-1+alpha1.2.2-21.2.3-11.2.3-1+powerpcspe11.2.4-11.2.4-1+powerpcspe11.2.4-21.2.4-31.3.0-11.3.0-21.3.2-11.3.2-21.3.2-31.3.2-41.3.3-11.3.4-11.3.4-2
1.3.5-1~deb7u1
graphite2
Debian:8
 before 1.3.5-1~deb8u1, plus listed versions
1.2.4-31.3.0-11.3.0-21.3.2-11.3.2-2
Show 6 moreShow less
1.3.2-31.3.2-41.3.3-11.3.4-11.3.4-21.3.5-1~deb7u1
1.3.5-1~deb8u1
icedove
Debian:7
 before 38.6.0-1~deb7u1, plus listed versions
10.0.12-111.0-116.0.2-117.0-117.0.10-1
Show 45 moreShow less
17.0.10-1+powerpcspe117.0.10-1+powerpcspe217.0.10-1~deb7u117.0.2-117.0.4-117.0.5-117.0.5-217.0.7-117.0.7-1~deb7u117.0.8-117.0.8-1~deb7u117.0.9-117.0.9-1~deb7u117.0.9-224.0-124.0~b3-224.1.1-124.2.0-124.2.0-1+alpha24.2.0-1+powerpcspe124.3.0-124.3.0-224.4.0-124.4.0-1~deb7u124.5.0-124.5.0-1~deb7u124.5.0-224.6.0-1~deb7u124.7.0-1~deb7u124.8.0-1~deb7u124.8.1-1~deb7u130.0~b1-131.0-131.0-231.0-331.0~b1-231.0~b2-131.1.2-131.2.0-131.2.0-1~deb7u131.3.0-131.3.0-1+powerpcspe131.3.0-1~deb7u131.4.0-131.4.0-1~deb7u1
38.6.0-1~deb7u1
icedove
Debian:8
 before 38.6.0-1~deb8u1, plus listed versions
31.6.0-131.7.0-131.7.0-1~deb7u131.7.0-1~deb8u131.8.0-1~deb7u1
Show 26 moreShow less
31.8.0-1~deb8u131.8.0-1~deb8u1+kbsd1132.0~b1-133.0~b1-134.0~b1-134.0~b1-236.0~b1-136.0~b1-238.0.1-138.0~b2-138.0~b5-138.1.0-138.2.0-138.2.0-1~stretch38.2.0-238.3.0-138.3.0-1~deb7u138.3.0-1~deb8u138.3.0-238.4.0-138.4.0-1~deb7u138.4.0-1~deb8u138.5.0-138.5.0-1~deb7u138.5.0-1~deb8u138.6.0-1~deb7u1
38.6.0-1~deb8u1
firefox
Mageia:5
 before 38.6.1-1.mga5
38.6.1-1.mga5
Show 44 moreShow less
Affected packages
PackageAffectedFixed
firefox-l10n
Mageia:5
 before 38.6.1-1.mga5
38.6.1-1.mga5
graphite2
Mageia:5
 before 1.3.5-1.mga5
1.3.5-1.mga5
thunderbird
Mageia:5
 before 38.6.0-1.mga5
38.6.0-1.mga5
thunderbird-l10n
Mageia:5
 before 38.6.0-1.mga5
38.6.0-1.mga5
graphite2
Red Hat:enterprise_linux:7::client
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::client
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::computenode
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::server
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::server
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::workstation
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
firefox
Red Hat:enterprise_linux:5::client
 before 0:45.1.0-1.el5_11
0:45.1.0-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:45.1.0-1.el5_11
0:45.1.0-1.el5_11
firefox
Red Hat:enterprise_linux:5::server
 before 0:45.1.0-1.el5_11
0:45.1.0-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:45.1.0-1.el5_11
0:45.1.0-1.el5_11
firefox
Red Hat:enterprise_linux:6::client
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox
Red Hat:enterprise_linux:6::computenode
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox
Red Hat:enterprise_linux:6::server
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox
Red Hat:enterprise_linux:6::workstation
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:45.1.0-1.el6_7
0:45.1.0-1.el6_7
firefox
Red Hat:enterprise_linux:7::client
 before 0:45.1.0-1.el7_2
0:45.1.0-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:45.1.0-1.el7_2
0:45.1.0-1.el7_2
firefox
Red Hat:enterprise_linux:7::server
 before 0:45.1.0-1.el7_2
0:45.1.0-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:45.1.0-1.el7_2
0:45.1.0-1.el7_2
firefox
Red Hat:enterprise_linux:7::workstation
 before 0:45.1.0-1.el7_2
0:45.1.0-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:45.1.0-1.el7_2
0:45.1.0-1.el7_2
graphite2
SUSE:Linux Enterprise Desktop 12
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Desktop 12 SP1
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Software Development Kit 12
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Server 12
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Server for SAP Applications 12
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Server 12 SP1
 before 1.3.1-6.1
1.3.1-6.1
graphite2
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 1.3.1-6.1
1.3.1-6.1
graphite2
Ubuntu:14.04:LTS
 before 1.2.4-1ubuntu1.1, plus listed versions
1.2.3-11.2.4-11.2.4-1ubuntu1
1.2.4-1ubuntu1.1
graphite2
Ubuntu:16.04:LTS
 before 1.3.5-1ubuntu1, plus listed versions
1.2.4-3ubuntu1
1.3.5-1ubuntu1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 86 moreShow less
This page doesn't list everything

Left out here: 167 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open