---
id: CVE-2026-92035
title: Sandbox escape due to incorrect boundary conditions in the Graphics component
summary: >-
  Sandbox escape due to incorrect boundary conditions in the Graphics component.
  This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR
  153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR
  14…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-119
  - CWE-501
vendor: mozilla
product: firefox
affected:
  - firefox < 115.42.0
  - 'firefox >= 116.0, < 140.17.0'
  - 'firefox >= 141.0, < 153.3.0'
  - 'firefox >= 154.0.0, < 156.0.0'
  - thunderbird < 140.17.0
  - 'thunderbird >= 141.0, < 153.3.0'
  - 'thunderbird >= 154.0, < 156.0'
patched:
  - firefox 156.0.0
  - thunderbird 156.0
published: '2026-09-15'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T17:59:39.483'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92035'
references:
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2061245'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-90/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-93/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-94/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-96/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-98/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/'
    label: security@mozilla.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92035.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92035'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2533789'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92035'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92035'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-90/#CVE-2026-92035'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-94/#CVE-2026-92035'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-92035'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-92035'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76764'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76850'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76761'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00328
epssPercentile: 0.25814
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T17:10:15.352556Z'
scores:
  nvd: 9.6
  vendor: 7.5
  adp: 9.6
ingestedAt: '2026-09-15T12:36:50.188Z'
---

## Overview

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.

## Affected

- `firefox < 115.42.0`
- `firefox >= 116.0, < 140.17.0`
- `firefox >= 141.0, < 153.3.0`
- `firefox >= 154.0.0, < 156.0.0`
- `thunderbird < 140.17.0`
- `thunderbird >= 141.0, < 153.3.0`
- `thunderbird >= 154.0, < 156.0`

## Remediation

Upgrade past the affected range:

- `firefox 156.0.0`
- `thunderbird 156.0`

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92035.json)
- **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764)
- **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850)
- **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761)