CVE-2021-4127

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially...

9.8 CriticalFix available

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.95%Up 0.1 points since Dec 23, 2022

What each source reports

NVD Score used 9.8

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Record: CVE-2021-4127
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

CVE List 9.8

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Record: CVE-2021-4127
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2021-34001 9.8

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Record: EUVD-2021-34001
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7wp9-fj5q-c4jc 9.8

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially...

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Record: GHSA-7wp9-fj5q-c4jc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Record: CVE-2021-4127
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-4127 9.8

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.

Record: DEBIAN-CVE-2021-4127
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSVRHSA-2021:0989 9.8

Red Hat Security Advisory: firefox security update

Record: RHSA-2021:0989
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0990 9.8

Red Hat Security Advisory: firefox security update

Record: RHSA-2021:0990
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0991 9.8

Red Hat Security Advisory: firefox security update

Record: RHSA-2021:0991
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0992 9.8

Red Hat Security Advisory: firefox security update

Record: RHSA-2021:0992
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0993 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2021:0993
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0994 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2021:0994
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0995 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2021:0995
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0996 9.8

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2021:0996
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2021-0163 No score

Updated firefox packages fix security vulnerabilities

Texture upload into an unbound backing buffer resulted in an out-of-bound read. (CVE-2021-23981)

Angle graphics library out of date. (CVE-2021-4127)

Internal network hosts could have been probed by a malicious webpage. (CVE-2021-23982)

Malicious extensions could have spoofed popup information. (CVE-2021-23984)

Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 (CVE-2021-23987).

Record: MGASA-2021-0163
Updated: 2026-11-02

OSVMGASA-2021-0164 No score

Updated thunderbird packages fix security vulnerabilities

Texture upload into an unbound backing buffer resulted in an out-of-bound read. (CVE-2021-23981)

Angle graphics library out of date. (CVE-2021-4127)

Internal network hosts could have been probed by a malicious webpage. (CVE-2021-23982)

Malicious extensions could have spoofed popup information. (CVE-2021-23984)

Memory safety bugs fixed in Thunderbird 78.9. (CVE-2021-23987)

Record: MGASA-2021-0164
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`firefox-esr` Debian:12	before 78.9.0esr-1	78.9.0esr-1
`firefox-esr` Debian:13	before 78.9.0esr-1	78.9.0esr-1
`firefox-esr` Debian:14	before 78.9.0esr-1	78.9.0esr-1
`thunderbird` Debian:12	before 1:78.9.0-1	1:78.9.0-1
`thunderbird` Debian:13	before 1:78.9.0-1	1:78.9.0-1
`thunderbird` Debian:14	before 1:78.9.0-1	1:78.9.0-1
`firefox-esr` Debian:10 From an advisory covering 6 CVEs	before 78.9.0esr-1~deb10u1, plus listed versions 60.7.2esr-160.8.0esr-160.8.0esr-1~deb10u160.8.0esr-1~deb8u160.8.0esr-1~deb9u1 Show 45 moreShow less 60.9.0esr-1~deb10u160.9.0esr-1~deb8u160.9.0esr-1~deb8u260.9.0esr-1~deb9u168.0.2esr-168.1.0esr-168.10.0esr-168.10.0esr-1~deb10u168.10.0esr-1~deb9u168.11.0esr-168.11.0esr-1~deb10u168.11.0esr-1~deb9u168.12.0esr-168.12.0esr-1~deb10u168.12.0esr-1~deb9u168.2.0esr-168.2.0esr-1~deb10u168.2.0esr-1~deb8u168.2.0esr-1~deb9u168.2.0esr-1~deb9u268.3.0esr-168.3.0esr-1~deb10u168.3.0esr-1~deb8u168.3.0esr-1~deb9u168.4.0esr-168.4.0esr-1~deb10u168.4.0esr-1~deb8u168.4.0esr-1~deb9u168.4.1esr-168.4.1esr-1~deb10u168.4.1esr-1~deb8u168.4.1esr-1~deb9u168.4.2esr-168.5.0esr-168.5.0esr-1~deb10u168.5.0esr-1~deb8u168.5.0esr-1~deb9u168.6.0esr-168.6.0esr-1~deb10u168.6.0esr-1~deb8u168.6.0esr-1~deb9u168.6.1esr-168.6.1esr-1~deb10u168.6.1esr-1~deb9u168.7.0esr-1	78.9.0esr-1~deb10u1
`thunderbird` Debian:10 From an advisory covering 6 CVEs	before 1:78.9.0-1~deb10u1, plus listed versions 1:60.7.2-11:60.8.0-11:60.8.0-1~deb10u11:60.8.0-1~deb8u11:60.8.0-1~deb9u1 Show 45 moreShow less 1:60.8.0-21:60.9.0-11:60.9.0-1~deb10u11:60.9.0-1~deb8u11:60.9.0-1~deb9u11:65.0~b1-11:66.0~b1-11:67.0~b3-11:68.0~b1-11:68.1.1-1~exp11:68.1.2-1~exp11:68.10.0-11:68.10.0-1~deb10u11:68.10.0-1~deb9u11:68.11.0-11:68.11.0-1~deb10u11:68.11.0-1~deb9u11:68.11.0-21:68.11.0-31:68.12.0-11:68.12.0-1~deb10u11:68.12.0-1~deb9u11:68.12.0-1~deb9u21:68.2.1-11:68.2.2-11:68.2.2-1~deb10u11:68.2.2-1~deb8u11:68.2.2-1~deb9u11:68.3.0-11:68.3.0-21:68.3.0-2~deb10u11:68.3.0-2~deb8u11:68.3.0-2~deb9u11:68.3.1-11:68.4.1-11:68.4.1-1~deb10u11:68.4.1-1~deb8u11:68.4.1-1~deb9u11:68.4.2-11:68.5.0-11:68.5.0-1~deb10u11:68.5.0-1~deb8u11:68.5.0-1~deb9u11:68.6.0-11:68.6.0-1~deb10u1	1:78.9.0-1~deb10u1
`nss` Mageia:7 From an advisory covering 5 CVEs	before 3.63.0-1.mga7	3.63.0-1.mga7
`nspr` Mageia:7 From an advisory covering 5 CVEs	before 4.30-1.mga7	4.30-1.mga7

Show 40 moreShow less

Affected packages
Package	Affected	Fixed
`firefox` Mageia:7 From an advisory covering 5 CVEs	before 78.9.0-1.mga7	78.9.0-1.mga7
`firefox-l10n` Mageia:7 From an advisory covering 5 CVEs	before 78.9.0-1.mga7	78.9.0-1.mga7
`nss` Mageia:8 From an advisory covering 5 CVEs	before 3.63.0-1.mga8	3.63.0-1.mga8
`nspr` Mageia:8 From an advisory covering 5 CVEs	before 4.30-1.mga8	4.30-1.mga8
`firefox` Mageia:8 From an advisory covering 5 CVEs	before 78.9.0-1.mga8	78.9.0-1.mga8
`firefox-l10n` Mageia:8 From an advisory covering 5 CVEs	before 78.9.0-1.mga8	78.9.0-1.mga8
`thunderbird-l10n` Mageia:7 From an advisory covering 5 CVEs	before 78.9.0-1.mga7	78.9.0-1.mga7
`thunderbird` Mageia:7 From an advisory covering 5 CVEs	before 78.9.0-1.mga7	78.9.0-1.mga7
`thunderbird-l10n` Mageia:8 From an advisory covering 5 CVEs	before 78.9.0-1.mga8	78.9.0-1.mga8
`thunderbird` Mageia:8 From an advisory covering 5 CVEs	before 78.9.0-1.mga8	78.9.0-1.mga8
`firefox` Red Hat:rhel_eus:8.2::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_2	0:78.9.0-1.el8_2
`firefox-debuginfo` Red Hat:rhel_eus:8.2::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_2	0:78.9.0-1.el8_2
`firefox-debugsource` Red Hat:rhel_eus:8.2::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_2	0:78.9.0-1.el8_2
`firefox` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_3	0:78.9.0-1.el8_3
`firefox-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_3	0:78.9.0-1.el8_3
`firefox-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_3	0:78.9.0-1.el8_3
`firefox` Red Hat:rhel_eus:8.1::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_1	0:78.9.0-1.el8_1
`firefox-debuginfo` Red Hat:rhel_eus:8.1::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_1	0:78.9.0-1.el8_1
`firefox-debugsource` Red Hat:rhel_eus:8.1::appstream From an advisory covering 5 CVEs	before 0:78.9.0-1.el8_1	0:78.9.0-1.el8_1
`firefox` Red Hat:enterprise_linux:7::client From an advisory covering 5 CVEs	before 0:78.9.0-1.el7_9	0:78.9.0-1.el7_9
`firefox-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 5 CVEs	before 0:78.9.0-1.el7_9	0:78.9.0-1.el7_9
`firefox` Red Hat:enterprise_linux:7::server From an advisory covering 5 CVEs	before 0:78.9.0-1.el7_9	0:78.9.0-1.el7_9
`firefox-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 5 CVEs	before 0:78.9.0-1.el7_9	0:78.9.0-1.el7_9
`firefox` Red Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs	before 0:78.9.0-1.el7_9	0:78.9.0-1.el7_9
`firefox-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs	before 0:78.9.0-1.el7_9	0:78.9.0-1.el7_9
`thunderbird` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_3	0:78.9.0-3.el8_3
`thunderbird-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_3	0:78.9.0-3.el8_3
`thunderbird-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_3	0:78.9.0-3.el8_3
`thunderbird` Red Hat:rhel_eus:8.2::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_2	0:78.9.0-3.el8_2
`thunderbird-debuginfo` Red Hat:rhel_eus:8.2::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_2	0:78.9.0-3.el8_2
`thunderbird-debugsource` Red Hat:rhel_eus:8.2::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_2	0:78.9.0-3.el8_2
`thunderbird` Red Hat:rhel_eus:8.1::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_1	0:78.9.0-3.el8_1
`thunderbird-debuginfo` Red Hat:rhel_eus:8.1::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_1	0:78.9.0-3.el8_1
`thunderbird-debugsource` Red Hat:rhel_eus:8.1::appstream From an advisory covering 5 CVEs	before 0:78.9.0-3.el8_1	0:78.9.0-3.el8_1
`thunderbird` Red Hat:enterprise_linux:7::client From an advisory covering 5 CVEs	before 0:78.9.0-3.el7_9	0:78.9.0-3.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 5 CVEs	before 0:78.9.0-3.el7_9	0:78.9.0-3.el7_9
`thunderbird` Red Hat:enterprise_linux:7::server From an advisory covering 5 CVEs	before 0:78.9.0-3.el7_9	0:78.9.0-3.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 5 CVEs	before 0:78.9.0-3.el7_9	0:78.9.0-3.el7_9
`thunderbird` Red Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs	before 0:78.9.0-3.el7_9	0:78.9.0-3.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs	before 0:78.9.0-3.el7_9	0:78.9.0-3.el7_9

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-4127 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox Esr, published March 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in firefox-esr 78.9.0esr-1.

References

Show 46 moreShow less

This page doesn't list everything

Left out here: 105 versions. The JSON record has them.