CVE-2026-92032

Awaiting Analysis Awaiting Analysis - Queue

Graphics Component Pointer Validation Flaw in Firefox

Publication date: 2026-09-15

Last updated on: 2026-10-05

Assigner: Mozilla Corporation

Description

Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-10-05

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92032

EUVD

EUVD-2026-78495

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 140.16.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.3.0 (exc)
mozilla	thunderbird	From 154.0 (inc) to 156.0 (exc)
mozilla	firefox	From 154.0.0 (inc) to 156.0.0 (exc)
mozilla	firefox	From 141.0 (inc) to 153.3.0 (exc)
mozilla	firefox	to 140.16.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to escape the sandbox environment due to an invalid pointer in the Graphics component of Firefox. This means malicious code could run outside the restricted sandbox, potentially gaining higher system access.

Detection Guidance

This vulnerability is a sandbox escape in Firefox's Graphics component. Detection requires checking Firefox version against patched releases (Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3). Use commands like 'firefox --version' or check about:support in Firefox to verify version.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system, leading to data theft, malware installation, or unauthorized system control. Users running vulnerable Firefox versions are at risk.

Compliance Impact

This vulnerability involves a sandbox escape due to an invalid pointer in the Graphics component, which could allow unauthorized access to system resources. Such vulnerabilities may impact compliance with standards like GDPR by potentially exposing personal data or violating data integrity, and with HIPAA by risking unauthorized access to protected health information.

Mitigation Strategies

Update Firefox to version 156 or later, Firefox ESR to version 140.16 or later, or Firefox ESR to version 153.3 or later to address the sandbox escape vulnerability.

Hi! I’m here to help you understand CVE-2026-92032. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70