Every CVE Search/ Get API key

CVE-2016-1522

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox...

8.8 HighFix available

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

8.31%Up 2.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
CVE-2016-1522
Updated
2026-11-02
EUVDEUVD-2016-2617 No score

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
EUVD-2016-2617
Updated
2026-11-03
GitHub AdvisoriesGHSA-g9c3-vp28-w6w3 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox...

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
GHSA-g9c3-vp28-w6w3
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-1522 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
DEBIAN-CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-1522 8.8

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

Record
UBUNTU-CVE-2016-1522
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0077 No score

Updated graphite2/firefox packages fix security vulnerability

Multiple vulnerabilities in the graphite2 font library can result in information disclosure, denial-of-service (application crashes), or code execution via out-of-bounds reads, a NULL pointer dereference, and a heap-based buffer overflow (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526).

Firefox includes a bundled copy of the graphite2 library, which has been updated in Firefox ESR 38.6.1.

Record
MGASA-2016-0077
Updated
2026-11-02
OSVMGASA-2016-0078 No score

Updated thunderbird packages fix security vulnerability

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2016-1930, CVE-2016-1935).

Multiple security flaws were found in the graphite2 font library bundled with Thunderbird. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526).

Thunderbird includes a bundled copy of the graphite2 library, which has been updated in Thunderbird 38.6.0.

Record
MGASA-2016-0078
Updated
2026-11-02
OSVUSN-2902-1 No score

graphite2 vulnerabilities

Yves Younan discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially- crafted font file, a remote attacker could use this issue to cause graphite2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-2902-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
graphite2
Debian:12
 before 1.3.5-1
1.3.5-1
graphite2
Debian:13
 before 1.3.5-1
1.3.5-1
graphite2
Debian:14
 before 1.3.5-1
1.3.5-1
graphite2
Debian:7
From an advisory covering 4 CVEs
 before 1.3.5-1~deb7u1, plus listed versions
1.1.3-11.1.3-1+powerpcspe11.2.0-11.2.0-21.2.0-3
Show 22 moreShow less
1.2.0-41.2.1-11.2.1-21.2.1-2+powerpcspe11.2.2-11.2.2-1+alpha1.2.2-21.2.3-11.2.3-1+powerpcspe11.2.4-11.2.4-1+powerpcspe11.2.4-21.2.4-31.3.0-11.3.0-21.3.2-11.3.2-21.3.2-31.3.2-41.3.3-11.3.4-11.3.4-2
1.3.5-1~deb7u1
graphite2
Debian:8
From an advisory covering 4 CVEs
 before 1.3.5-1~deb8u1, plus listed versions
1.2.4-31.3.0-11.3.0-21.3.2-11.3.2-2
Show 6 moreShow less
1.3.2-31.3.2-41.3.3-11.3.4-11.3.4-21.3.5-1~deb7u1
1.3.5-1~deb8u1
firefox
Mageia:5
From an advisory covering 4 CVEs
 before 38.6.1-1.mga5
38.6.1-1.mga5
firefox-l10n
Mageia:5
From an advisory covering 4 CVEs
 before 38.6.1-1.mga5
38.6.1-1.mga5
graphite2
Mageia:5
From an advisory covering 4 CVEs
 before 1.3.5-1.mga5
1.3.5-1.mga5
thunderbird
Mageia:5
From an advisory covering 6 CVEs
 before 38.6.0-1.mga5
38.6.0-1.mga5
thunderbird-l10n
Mageia:5
From an advisory covering 6 CVEs
 before 38.6.0-1.mga5
38.6.0-1.mga5
Show 49 moreShow less
Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el5_11
0:38.6.1-1.el5_11
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el6_7
0:38.6.1-1.el6_7
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:38.6.1-1.el7_2
0:38.6.1-1.el7_2
thunderbird
Red Hat:enterprise_linux:5::client
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird
Red Hat:rhel_productivity:5
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird-debuginfo
Red Hat:rhel_productivity:5
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el5_11
0:38.6.0-1.el5_11
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el6_7
0:38.6.0-1.el6_7
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 5 CVEs
 before 0:38.6.0-1.el7_2
0:38.6.0-1.el7_2
graphite2
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::computenode
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:1.3.6-1.el7_2
0:1.3.6-1.el7_2
graphite2
Ubuntu:14.04:LTS
 before 1.2.4-1ubuntu1.1, plus listed versions
1.2.3-11.2.4-11.2.4-1ubuntu1
1.2.4-1ubuntu1.1
graphite2
Ubuntu:16.04:LTS
 before 1.3.5-1ubuntu1, plus listed versions
1.2.4-3ubuntu1
1.3.5-1ubuntu1
graphite2
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
 before 1.2.4-1ubuntu1.1, plus listed versions
1.2.3-11.2.4-11.2.4-1ubuntu1
1.2.4-1ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1522 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published February 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.31%, the 94th percentile. Fixed in graphite2 1.3.5-1.

References

Show 73 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open