CVE-2016-2793: CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x befo...

Security readout for executives and security teams

A malicious Graphite smart font could make vulnerable software using Graphite 2 read past a buffer. Public text names denial of service and possible unspecified other impact. The clearest affected chain is Graphite 2 before 1.3.6, including Mozilla Firefox before 45.0 and Firefox ESR before 38.7. This is old, but embedded libraries or legacy browsers may still matter. Exposure is most likely in legacy Linux packages, legacy Firefox builds, Firefox ESR 38.x before 38.7, or applications bundling old Graphite 2. Modern fully patched browsers and distributions are less likely to be affected. Treat as a legacy exposure cleanup item unless old browsers, Linux desktops, document-rendering workflows, or bundled Graphite 2 components remain in use. Prioritize patch verification for systems that process untrusted fonts or documents. Mitigation focus: Upgrade Graphite 2 to 1.3.6 or later where applicable.; Upgrade Firefox to 45.0 or later, and ESR to 38.7 or later.; Apply relevant Linux vendor security updates for affected packages..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.