Loading vulnerability…
Incorrect boundary conditions in Mozilla Firefox and Thunderbird Graphics
CVE-2026-16357 is an incorrect-boundary-condition vulnerability in the Graphics component of Mozilla Firefox and Thunderbird. The affected function and precise boundary-checking error are not specified. The vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation may cause memory-safety issues in the Graphics component, but the specific security consequences are not established. Arbitrary code execution and other impacts described for the broader security updates are not individually attributed to CVE-2026-16357.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Apply the relevant product or distribution security update.
Patch, then assume compromise.
Upgrade to Firefox 153 or later, Firefox ESR 115.38 or later, Firefox ESR 140.13 or later, Thunderbird 153 or later, or Thunderbird 140.13 or later within the applicable supported branch. On Debian 13 (trixie), install firefox-esr 140.13.0esr-1~deb13u1 or later, or thunderbird 1:140.13.0esr-2~deb13u1 or later, through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.