{"id":"CVE-2026-92035","title":"Sandbox escape due to incorrect boundary conditions in the Graphics component","summary":"Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 14…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-119","CWE-501"],"vendor":"mozilla","product":"firefox","affected":["firefox < 115.42.0","firefox >= 116.0, < 140.17.0","firefox >= 141.0, < 153.3.0","firefox >= 154.0.0, < 156.0.0","thunderbird < 140.17.0","thunderbird >= 141.0, < 153.3.0","thunderbird >= 154.0, < 156.0"],"patched":["firefox 156.0.0","thunderbird 156.0"],"published":"2026-09-15","updated":"2026-10-05","sourceUpdated":"2026-10-05T17:59:39.483","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92035","references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2061245","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-90/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-93/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-94/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-96/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-98/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-99/","label":"security@mozilla.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92035.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-92035"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533789"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92035"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92035"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-90/#CVE-2026-92035"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-94/#CVE-2026-92035"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-92035"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-92035"},{"url":"https://access.redhat.com/errata/RHSA-2026:76764"},{"url":"https://access.redhat.com/errata/RHSA-2026:76850"},{"url":"https://access.redhat.com/errata/RHSA-2026:76761"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00328,"epssPercentile":0.25814,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-21T17:10:15.352556Z"},"scores":{"nvd":9.6,"vendor":7.5,"adp":9.6},"ingestedAt":"2026-09-15T12:36:50.188Z","slug":"CVE-2026-92035","body":"## Overview\n\nSandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.\n\n## Affected\n\n- `firefox < 115.42.0`\n- `firefox >= 116.0, < 140.17.0`\n- `firefox >= 141.0, < 153.3.0`\n- `firefox >= 154.0.0, < 156.0.0`\n- `thunderbird < 140.17.0`\n- `thunderbird >= 141.0, < 153.3.0`\n- `thunderbird >= 154.0, < 156.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `firefox 156.0.0`\n- `thunderbird 156.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92035.json)\n- **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764)\n- **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850)\n- **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208654,"id":"CVE-2026-92035","ts":1790016691836,"field":"cvss","old":"7.5","new":"9.6"},{"seq":208653,"id":"CVE-2026-92035","ts":1790016691836,"field":"severity","old":"high","new":"critical"},{"seq":206370,"id":"CVE-2026-92035","ts":1789663223608,"field":"cvss","old":null,"new":"7.5"},{"seq":206369,"id":"CVE-2026-92035","ts":1789663223608,"field":"severity","old":"none","new":"high"}]}