CVE-2026-5732

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux Server (v. 7 ELS)—
Red HatRed Hat Enterprise Linux AppStream EUS (v. 10.0)—
Red HatRed Hat Enterprise Linux AppStream (v. 10)—
Red HatRed Hat Enterprise Linux AppStream (v. 8)—
Red HatRed Hat Enterprise Linux AppStream AUS (v. 8.2)—
Red HatRed Hat Enterprise Linux AppStream AUS (v.8.4)—
Red HatRed Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)—
Red HatRed Hat Enterprise Linux AppStream AUS (v.8.6)—
Red HatRed Hat Enterprise Linux AppStream E4S (v.8.6)—
Red HatRed Hat Enterprise Linux AppStream TUS (v.8.6)—
Red HatRed Hat Enterprise Linux AppStream E4S (v.8.8)—
Red HatRed Hat Enterprise Linux AppStream TUS (v.8.8)—
Red HatRed Hat Enterprise Linux AppStream E4S (v.9.0)—
Red HatRed Hat Enterprise Linux AppStream E4S (v.9.2)—
Red HatRed Hat Enterprise Linux AppStream EUS (v.9.4)—
Red HatRed Hat Enterprise Linux AppStream EUS (v.9.6)—
Red HatRed Hat Enterprise Linux AppStream (v. 9)—

References

Timeline

Published
Apr 7, 2026
Last modified
Oct 24, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-573207.1Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.CVE-2026-573217.1Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.CVE-2026-573227.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected CVE-2026-573235.8Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-573246.5Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.CVE-2026-573257.1Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.CVE-2026-573266.1Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.CVE-2026-573276.3Subscriber Broken Access Control in MainWP <= 6.1.1 versions.CVE-2026-573286.5Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.CVE-2026-573296.5Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.CVE-2026-57338.8Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.CVE-2026-573306.5Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.