{"id":"CVE-2026-120572","published":"2026-11-03T14:17:35.447","lastModified":"2026-11-03T16:15:28.703","description":"Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-119"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2079035","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-123/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow in Firefox's Layout: Block and Inline component due to incorrect boundary checks can allow an attacker to execute arbitrary code in the context of the browser when a user visits a malicious webpage.","exploitability":"Exploitation requires user interaction (e.g., visiting a crafted webpage) and is non-trivial but feasible given the high CVSS score and presence of memory corruption.","blast_radius":"Successful exploitation could lead to full compromise of the affected browser, including theft of sensitive data, session hijacking, or installation of persistent malware.","remediation":"Upgrade to Firefox 159.0.1 or later, as explicitly stated in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","memory-corruption","web-browser","cwe-119"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:56:59.741Z"}}