What is CVE-2016-1526?

CVE-2016-1526 is a high-severity vulnerability in Mozilla Firefox, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.1/10. Published 2016-02-13.

How severe is CVE-2016-1526?

High severity. CVSS v3 base score is 8.1 out of 10.

Buffer overflow in Mozilla Firefox

CVE-2016-1526

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Vulnerability class: Buffer Overflow

Published 2016-02-13 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H.

EPSS exploit prediction

EPSS: 0.023 (82.3th percentile), scored 2026-09-28.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 82.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000

Affected products

Mozilla Firefox — versions 38.0, 38.0.1, 38.0.5
Mozilla Thunderbird
Sil Graphite2 — versions 1.2.4
Debian Linux — versions 7.0, 8.0
Fedoraproject Fedora — versions 22, 23

Weakness classification (CWE)

References

lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html (vendor-advisory)
security.gentoo.org/glsa/201701-35 (vendor-advisory)
www.securityfocus.com/bid/82991 (vdb-entry)
www.ubuntu.com/usn/USN-2902-1 (vendor-advisory)
www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
rhn.redhat.com/errata/RHSA-2016-0695.html (vendor-advisory)
rhn.redhat.com/errata/RHSA-2016-0594.html (vendor-advisory)
lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html (vendor-advisory)
www.debian.org/security/2016/dsa-3479 (vendor-advisory, Third Party Advisory)
blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html (Third Party Advisory)

Frequently asked questions

What is CVE-2016-1526?: CVE-2016-1526 is a high-severity vulnerability in Mozilla Firefox, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.1/10. Published 2016-02-13.
How severe is CVE-2016-1526?: High severity. CVSS v3 base score is 8.1 out of 10.