CVE-2018-12371

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.

• CWE-190

• https://bugzilla.mozilla.org/show_bug.cgi?id=1465686Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1465686Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory

Published

Jul 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12366An invalid grid size during QCMS (color profile) transformat…
• CVE-2018-12367In the previous mitigations for Spectre, the resolution or p…
• CVE-2018-12368Windows 10 does not warn users before opening executable fil…
• CVE-2018-12369WebExtensions bundled with embedded experiments were not cor…
• CVE-2018-1237Dell EMC ScaleIO versions prior to 2.5, contain improper res…
• CVE-2018-12370In Reader View SameSite cookie protections are not checked o…
• CVE-2018-12372Decrypted S/MIME parts, when included in HTML crafted for an…
• CVE-2018-12373dDecrypted S/MIME parts hidden with CSS or the plaintext HTM…
• CVE-2018-12374Plaintext of decrypted emails can leak through by user submi…
• CVE-2018-12375Memory safety bugs present in Firefox 61. Some of these bugs…
• CVE-2018-12376Memory safety bugs present in Firefox 61 and Firefox ESR 60.…
• CVE-2018-12377A use-after-free vulnerability can occur when refresh driver…