{"id":"CVE-2026-117993","kind":"vulnerability","aliases":["CVE-2026-117993"],"related":[],"title":"Firefox: integer overflow in Graphics Text component, fixed in 159","description":"Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"An integer overflow in the Graphics: Text component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker can achieve with it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","firefox-esr","runtime"],"not_affected_if":["already-updated"],"how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`\n- Check the ESR build version if running Firefox ESR, against `153.6`","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:34:55+00:00","updated_at":"2026-10-27T14:34:55+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:34:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: integer overflow in Graphics Text component, fixed in 159","impact":"medium","summary":"An integer overflow in the Graphics: Text component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker can achieve with it.","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the impact","analyst_note":"Find the Mozilla security advisory for the fixed Firefox 159 and ESR 153.6 release to confirm impact, trigger and whether it is reachable from web content.","how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`\n- Check the ESR build version if running Firefox ESR, against `153.6`","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions is affected. Systems already on Firefox 159 or ESR 153.6 or later are not. The sources do not describe the trigger or the data path, so whether a web page alone can reach the flaw is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3236,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117993':13A,16A '-2026':12A,15A '153.6':43B,71C '159':10A,39B,67C 'achiev':53B 'attack':51B 'browser':19B 'compon':7A,32B,60C 'cve':11A,14A 'desktop':18B 'desktop-brows':17B 'esr':23B,42B,70C 'firefox':1A,20B,22B,34B,38B,41B,66C,69C 'firefox-esr':21B 'fix':8A,36B,64C 'graphic':5A,30B,58C 'integ':2A,26B,54C 'overflow':3A,27B,55C 'runtim':24B 'say':48B 'sourc':45B 'text':6A,31B,59C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions is affected. Systems already on Firefox 159 or ESR 153.6 or later are not. The sources do not describe the trigger or the data path, so whether a web page alone can reach the flaw is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117993","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}