CVE-2026-92014

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=2060000	Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-91/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-92/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-95/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

History

06 Oct 2026, 14:45

Type	Values Removed	Values Added
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=2060000 -~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=2060000 - Permissions Required
References	~~() https://www.mozilla.org/security/advisories/mfsa2026-91/ -~~	() https://www.mozilla.org/security/advisories/mfsa2026-91/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2026-92/ -~~	() https://www.mozilla.org/security/advisories/mfsa2026-92/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2026-95/ -~~	() https://www.mozilla.org/security/advisories/mfsa2026-95/ - Vendor Advisory
First Time		Mozilla thunderbird Mozilla Mozilla firefox
CPE		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::

Information

Published : 2026-09-15 13:16

Updated : 2026-10-06 14:45

NVD link : CVE-2026-92014

Mitre link : CVE-2026-92014

CVE.ORG link : CVE-2026-92014

JSON object : View

Products Affected

mozilla

firefox
thunderbird

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2026-92014", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92014", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-15T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "115.41", "versionType": "rpm", "lessThanOrEqual": "115.*"}, {"status": "unaffected", "version": "140.16", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "140.16", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2026-09-15T13:16:50.887", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2060000", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-91/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-92/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-95/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16."}], "lastModified": "2026-10-06T14:45:45.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D2B33D-16FF-4D87-8AA0-DEDA7B0D82CE", "versionEndExcluding": "115.41.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9D0586D-1D81-4A96-9EDD-9C6903FC4D85", "versionEndExcluding": "140.16.0", "versionStartIncluding": "116.0"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C99D0A79-EF69-4D40-B061-9706D3881941", "versionEndExcluding": "140.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}