Critical· 9.8official fix available
CVE-2026-16357
A flaw in the Graphics component of certain software allows for incorrect boundary handling. This can lead to memory corruption when processing specific graphical data.
publishedJul 21, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
33th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 22, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of Firefox (versions prior to 153 or ESR 115.38/140.13) and Thunderbird (versions prior to 153 or 140.13).
02
Real-world impact
An attacker could potentially execute arbitrary code or cause the application to crash by sending specially crafted graphics data.
03
Why this severity
This is a critical vulnerability because it can be exploited remotely over the network without any user interaction or special privileges, potentially leading to a total compromise of the application.
04
What to do about it
official fix available
recommended steps
- 01Upgrade Firefox to version 153 or later.
- 02Upgrade Firefox ESR to version 115.38 or 140.13 or later.
- 03Upgrade Thunderbird to version 153 or 140.13 or later.
NVD-referenced vendor advisory
05
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- bugzilla.mozilla.org/show_bug.cgipermissions required
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →