CVE-2017-5436: Mozilla Thunderbird vulnerability

CVE-2017-5436: An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 5, 2024, 15:04 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

CVE-2017-5436 is a memory corruption flaw in the Graphite 2 font library. A malicious Graphite font could crash affected Mozilla products and may be exploitable. The practical concern is legacy Firefox, Firefox ESR, Thunderbird, or OS packages that still include unfixed Graphite 2 code.

Executive priority

Prioritize remediation where old browser or email clients handle untrusted content. The vulnerability is old and not KEV-listed in the supplied data, but memory corruption in user-facing clients can still create meaningful endpoint risk when legacy software remains deployed.

Technical view

The issue is an out-of-bounds write in Graphite 2 when processing a crafted Graphite font. Sources state it was fixed in Graphite 2 and Mozilla products, affecting Thunderbird before 52.1, Firefox ESR before 45.9 and 52.1, and Firefox before 53.

Likely exposure

Exposure is most likely in outdated endpoints, embedded systems, or managed desktop images still running affected Mozilla releases or unpatched distribution packages containing Graphite 2. Modern fully updated Firefox, Thunderbird, and Linux packages should not be assumed vulnerable based on the supplied sources.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is described as a potentially exploitable crash triggered by maliciously crafted font content, which makes untrusted web or mail content relevant in affected clients.

Researcher notes

Evidence is sufficient for affected Mozilla version boundaries and vulnerability class, but the bundle lacks CVSS, CWE, exploit maturity details, and exact Graphite 2 fixed version identifiers. Treat distribution advisories as authoritative for package-level remediation.

Mitigation direction

Upgrade Firefox to 53 or later where applicable.
Upgrade Thunderbird to 52.1 or later where applicable.
Upgrade Firefox ESR beyond the affected ESR versions.
Apply vendor Graphite 2 and Mozilla package updates from your OS distributor.
Check Mozilla and distribution advisories for product-specific fixed package versions.

Validation and detection

Inventory Firefox, Firefox ESR, Thunderbird, and Graphite 2 versions on endpoints.
Compare installed versions against Mozilla affected version thresholds.
Review Linux package manager security advisories for Graphite 2 fixes.
Confirm legacy desktop images are rebuilt with fixed browser and mail packages.
Track exceptions where affected clients cannot be upgraded.

Prepared: Jun 7, 2026, 06:44 UTC (UTC+00:00)
Confidence: high
Sources: 12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-5436 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 11, 2018, 21:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
RHSA-2017:1106CVE reference · vendor-advisory, x_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2017-12/CVE reference · x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2017-11/CVE reference · x_refsource_CONFIRM
GLSA-201706-25CVE reference · vendor-advisory, x_refsource_GENTOO
https://www.mozilla.org/security/advisories/mfsa2017-10/CVE reference · x_refsource_CONFIRM
DSA-3831CVE reference · vendor-advisory, x_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2017-13/CVE reference · x_refsource_CONFIRM
RHSA-2017:1104CVE reference · vendor-advisory, x_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1345461CVE reference · x_refsource_CONFIRM
RHSA-2017:1201CVE reference · vendor-advisory, x_refsource_REDHAT

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

MozillaThunderbirdunspecifiedListed

MozillaFirefox ESRunspecified, unspecifiedListed

MozillaFirefoxunspecifiedListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.