Search for vulnerabilities
Vulnerability details: VCID-u62c-xz51-fbd4
Vulnerability ID VCID-u62c-xz51-fbd4
Aliases CVE-2016-2790
Summary Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2790
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2016-37
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2790.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2790
1315795 https://bugzilla.redhat.com/show_bug.cgi?id=1315795
CVE-2016-2790 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2790
mfsa2016-37 https://www.mozilla.org/en-US/security/advisories/mfsa2016-37
RHSA-2016:0373 https://access.redhat.com/errata/RHSA-2016:0373
RHSA-2016:0460 https://access.redhat.com/errata/RHSA-2016:0460
USN-2917-1 https://usn.ubuntu.com/2917-1/
USN-2927-1 https://usn.ubuntu.com/2927-1/
USN-2934-1 https://usn.ubuntu.com/2934-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.72878
EPSS Score 0.00787
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:12.455457+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2016/mfsa2016-37.md 37.0.0