CVE-2017-5436An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.
Updated under an hour ago ()
Does this affect you?
It affects debian_linux and 9 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
- CVSS
- 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-787
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
debian debian_linux debian:debian_linux | 8.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 6.0; 7.0 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 6.0; 7.0 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 6.0; 7.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 7.3; 7.4 | NVD |
redhat enterprise_linux_server_eus redhat:enterprise_linux_server_eus | 7.3; 7.4; 7.5 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 6.0; 7.0 | NVD |
sil graphite2 sil:graphite2 | before 1.3.10 | NVD |
mozilla firefox mozilla:firefox | before 45.9.0; from 46.0 before 52.1.0 | NVD |
mozilla thunderbird mozilla:thunderbird | before 52.1.0 | NVD |
References
- http://www.securityfocus.com/bid/97940third-party-advisory, vdb-entry
- http://www.securitytracker.com/id/1038320third-party-advisory, vdb-entry
- https://access.redhat.com/errata/RHSA-2017:1104third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:1106third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:1201third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1345461issue-tracking, vendor-advisory
- https://security.gentoo.org/glsa/201706-25third-party-advisory
- https://www.debian.org/security/2017/dsa-3831third-party-advisory
- https://www.mozilla.org/security/advisories/mfsa2017-10/vendor-advisory
- https://www.mozilla.org/security/advisories/mfsa2017-11/vendor-advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/vendor-advisory
- https://www.mozilla.org/security/advisories/mfsa2017-13/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.