CVE-2026-0879
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.
CVSS
9.8
Critical
EPSS
0.5%
p41
KEV
—
Exploit Today
12
0-100
Published: Jan 13, 2026 · Last modified: Jul 15, 2026 · CWE-119
0.5%EPSS · 30 days0.5%
2026-06-302026-07-17
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2004602
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-01/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-02/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-03/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-04/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-05/
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:0667
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:0694
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:0924
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1320
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1413
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1414
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1415
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1461
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1462
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1471
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:1487
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:2041
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:2043
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:2044
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-312778.8 HIG71.0%
KEV—71Apple Multiple Products Buffer Overflow Vulnerability3dCVE-2005-445910.0 NO 96.2%
——29Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted (1) EPRT and (2) PORT FTP commands.10dCVE-2011-40454.3 NO 88.5%
——27Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.9dCVE-2025-434338.8 HIG62.4%
——19The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption.3dCVE-2025-432146.5 MED57.6%
——17The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.3dCVE-2025-434414.3 MED55.9%
——17The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.3d