CVE-2026-100782
HIGHCVSS 8.8Description
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Timeline
Published:September 29th, 2026 1:17 PM
Last modified:October 5th, 2026 1:50 PM
CVSS Scoring
CVSS v3: 8.8 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Software
From NVD CPE configuration data
Vendors
mozilla
Products
firefoxthunderbird
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://bugzilla.mozilla.org/show_bug.cgi?id=2068456Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-100/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-101/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-102/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-103/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-97/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-98/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-99/Vendor Advisory
Source: NIST NVD · Data may lag official sources by up to one minute