CVE-2016-1969: The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38....

Security readout for executives and security teams

CVE-2016-1969 is a flaw in Graphite 2 font handling used by older Firefox versions. A malicious Graphite smart font could crash the browser and may have had other unspecified impact. The sources identify fixed versions, but do not provide CVSS scoring or confirmed exploitation. Exposure is mainly legacy systems running Graphite 2 before 1.3.6, Firefox before 45.0, or Firefox ESR 38.x before 38.6.1. Current, maintained browser fleets are unlikely to be affected, but long-lived enterprise images and embedded Linux builds should be checked. Prioritize this as legacy risk reduction. It is old and not KEV-listed, but the affected component sits in browser font parsing, which can be exposed by ordinary web content or documents containing fonts. Mitigation focus: Upgrade Graphite 2 to 1.3.6 or later where independently packaged.; Upgrade Firefox to 45.0 or later.; Upgrade Firefox ESR 38.x to 38.6.1 or later..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.