Search for vulnerabilities
Vulnerability details: VCID-yrhc-hchg-7kf3
Vulnerability ID VCID-yrhc-hchg-7kf3
Aliases CVE-2016-2796
Summary Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
epss 0.00683 https://api.first.org/data/v1/epss?cve=CVE-2016-2796
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2016-37
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2796.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2796
1315795 https://bugzilla.redhat.com/show_bug.cgi?id=1315795
CVE-2016-2796 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2796
mfsa2016-37 https://www.mozilla.org/en-US/security/advisories/mfsa2016-37
RHSA-2016:0373 https://access.redhat.com/errata/RHSA-2016:0373
RHSA-2016:0460 https://access.redhat.com/errata/RHSA-2016:0460
USN-2917-1 https://usn.ubuntu.com/2917-1/
USN-2927-1 https://usn.ubuntu.com/2927-1/
USN-2934-1 https://usn.ubuntu.com/2934-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.70726
EPSS Score 0.00683
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:12.695951+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2016/mfsa2016-37.md 37.0.0