--- id: CVE-2026-100782 title: >- Privilege escalation due to incorrect boundary conditions in the Graphics component summary: >- Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox … severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-119 vendor: mozilla product: firefox affected: - firefox < 115.42.0 - 'firefox >= 116.0, < 140.17.0' - 'firefox >= 141.0, < 153.4.0' - 'firefox >= 154.0.0, < 157.0.0' - thunderbird < 140.17.0 - 'thunderbird >= 141.0, < 153.4.0' - 'thunderbird >= 154.0, < 157.0' patched: - firefox 157.0.0 - thunderbird 157.0 published: '2026-09-29' updated: '2026-10-05' sourceUpdated: '2026-10-05T13:50:14.003' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100782' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2068456' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-100/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-101/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-103/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-97/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-98/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100782.json - url: 'https://access.redhat.com/security/cve/CVE-2026-100782' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543152' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-100782' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100782' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100782' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100782' - url: 'https://access.redhat.com/errata/RHSA-2026:85240' - url: 'https://access.redhat.com/errata/RHSA-2026:76764' - url: 'https://access.redhat.com/errata/RHSA-2026:80674' - url: 'https://access.redhat.com/errata/RHSA-2026:76850' - url: 'https://access.redhat.com/errata/RHSA-2026:85243' - url: 'https://access.redhat.com/errata/RHSA-2026:85242' - url: 'https://access.redhat.com/errata/RHSA-2026:85241' - url: 'https://access.redhat.com/errata/RHSA-2026:85244' - url: 'https://access.redhat.com/errata/RHSA-2026:76761' - url: 'https://access.redhat.com/errata/RHSA-2026:80694' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00259 epssPercentile: 0.17438 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-09-29T13:16:23.464963Z' ingestedAt: '2026-09-29T13:34:31.662Z' scores: nvd: 8.8 vendor: 7.5 --- ## Overview Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. ## Affected - `firefox < 115.42.0` - `firefox >= 116.0, < 140.17.0` - `firefox >= 141.0, < 153.4.0` - `firefox >= 154.0.0, < 157.0.0` - `thunderbird < 140.17.0` - `thunderbird >= 141.0, < 153.4.0` - `thunderbird >= 154.0, < 157.0` ## Remediation Upgrade past the affected range: - `firefox 157.0.0` - `thunderbird 157.0` ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100782.json) - **RHSA-2026:85240** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85240) - **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764) - **RHSA-2026:80674** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80674) - **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850) - **RHSA-2026:85243** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85243) - **RHSA-2026:85242** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85242) - **RHSA-2026:85241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85241) - **RHSA-2026:85244** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85244) - **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761) - **RHSA-2026:80694** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80694)