Mozilla Firefox CVE-2026-109723

Exploitation requires the victim to use an affected Firefox build (prior to Firefox 158 or ESR 153.5) and to load attacker-controlled web content that exercises the Layout: Text and Fonts code path with malformed text/font data that triggers the CWE-190 integer overflow. The principal limiting factor is mandatory user interaction (UI:R) - the user must navigate to or render the malicious page; there is no authentication requirement (PR:N). No special non-default Firefox configuration is indicated in the description, so default installations rendering web content are in scope, but the attacker cannot act purely remotely without the victim loading the content, and impact is bounded (no availability impact, only limited confidentiality/integrity).

Signals are consistent and point to a moderate, low-priority issue despite Firefox's massive install base. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - i.e. the victim must load attacker-controlled web content - and yields only partial confidentiality and integrity impact with no availability impact. EPSS is low at 0.15% (4th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of exploitation pressure. The Integer Overflow/Buffer Overflow tags and CWE-190 in the Layout text/font engine raise the theoretical specter of memory corruption, but the vendor-assigned C:L/I:L/A:N impact and absence of an RCE/high-availability rating suggest the overflow does not translate into a reliably weaponizable code-execution primitive here. No SSVC decision data was provided in the input, so automatable/technical-impact fields could not be factored in. Net: a real but not urgent browser memory-safety bug - patch in normal cycle rather than emergency.

An attacker crafts a malicious web page containing specially constructed text or font layout data that triggers the integer overflow in Firefox's Layout: Text and Fonts component when the victim browses to the page. Because user interaction is required (UI:R), the victim must be lured to the attacker-controlled or compromised site; successful exploitation leaks limited in-process information or corrupts limited state (C:L/I:L). No public proof-of-concept exploit has been identified at time of analysis.