CVE-2016-2795: The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox befor...

Security readout for executives and security teams

CVE-2016-2795 is a flaw in Graphite 2 font handling used by affected Firefox versions. A crafted Graphite smart font could crash the application, and the public description leaves room for other unknown impact. The evidence names fixed versions but provides no CVSS score. Exposure is most likely on systems running old Firefox, Firefox ESR, or Linux packages that included vulnerable Graphite 2 before 1.3.6. Modern fully patched browsers and distributions are unlikely to be affected, but legacy desktops, frozen images, and unsupported appliances should be checked. Handle through legacy exposure management rather than emergency response unless vulnerable systems are still in use. The main business concern is disruption or uncertain impact from malicious font content on outdated clients. Patch or retire affected software during the next risk-based endpoint remediation cycle. Mitigation focus: Upgrade Graphite 2 to 1.3.6 or later where separately packaged.; Upgrade Firefox to 45.0 or later and Firefox ESR to 38.7 or later.; Apply relevant vendor updates from Mozilla, Debian, Ubuntu, SUSE, or your distribution..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.