CVE-2016-1526

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

• CWE-119
• CWE-200

• http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html
• http://rhn.redhat.com/errata/RHSA-2016-0594.html
• http://rhn.redhat.com/errata/RHSA-2016-0695.html
• http://www.debian.org/security/2016/dsa-3479Third Party Advisory
• http://www.mozilla.org/security/announce/2016/mfsa2016-14.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• http://www.securityfocus.com/bid/82991
• http://www.ubuntu.com/usn/USN-2902-1
• https://security.gentoo.org/glsa/201701-35
• https://security.gentoo.org/glsa/201701-63
• http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html
• http://rhn.redhat.com/errata/RHSA-2016-0594.html
• http://rhn.redhat.com/errata/RHSA-2016-0695.html
• http://www.debian.org/security/2016/dsa-3479Third Party Advisory
• http://www.mozilla.org/security/announce/2016/mfsa2016-14.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• http://www.securityfocus.com/bid/82991
• http://www.ubuntu.com/usn/USN-2902-1
• https://security.gentoo.org/glsa/201701-35
• https://security.gentoo.org/glsa/201701-63

Published

Feb 13, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1520The Grandstream Wave app 1.0.1.26 and earlier for Android do…
• CVE-2016-1521The directrun function in directmachine.cpp in Libgraphite i…
• CVE-2016-1522Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozi…
• CVE-2016-1523The SillMap::readFace function in FeatureMap.cpp in Libgraph…
• CVE-2016-1524Multiple unrestricted file upload vulnerabilities in NETGEAR…
• CVE-2016-1525Directory traversal vulnerability in data/config/image.do in…
• CVE-2016-1531Exim before 4.86.2, when installed setuid root, allows local…
• CVE-2016-1541Heap-based buffer overflow in the zip_read_mac_metadata func…
• CVE-2016-1542The RPC API in RSCD agent in BMC BladeLogic Server Automatio…
• CVE-2016-1543The RPC API in the RSCD agent in BMC BladeLogic Server Autom…
• CVE-2016-1544nghttp2 before 1.7.1 allows remote attackers to cause a deni…3.3
• CVE-2016-1546The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is …