{"id":"CVE-2026-109730","published":"2026-10-13T13:17:23.527","lastModified":"2026-10-15T20:17:07.620","description":"Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-190"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2074896","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-106/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-107/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-108/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-110/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An integer overflow vulnerability in Firefox's graphics component can lead to memory corruption and potentially arbitrary code execution when processing specially crafted images or web content. This affects both Firefox and Thunderbird browsers.","exploitability":"Exploitation requires a user visiting a malicious website with crafted graphics content, making it moderately difficult but possible with social engineering, and relies on the browser rendering the vulnerable graphics components.","blast_radius":"The vulnerability could affect millions of users who browse the web with Firefox or Thunderbird, potentially leading to full system compromise through remote code execution when they view compromised web pages or email attachments.","remediation":"Upgrade to Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["browser","memory-corruption","rce"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:04:00.003Z"}}