CVE-2026-120572: Incorrect boundary conditions in the Layout: Block and Inline component

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with low attack complexity and no privileges required, but user interaction is required. This suggests a user would need to interact with attacker-controlled content.

Q: Which Firefox versions are known to be fixed?

The issue was fixed in Firefox 159.0.1. The provided data does not identify the first affected version or whether other Firefox release channels are affected.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is classified as a buffer overflow with high confidentiality, integrity, and availability impact in the provided CVSS vector. Successful exploitation could therefore affect data confidentiality, modify data, or disrupt availability.

Published Nov 3, 2026

Updated

Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.

Affected Software

1 affected componentFixes available

Mozilla Firefox<159.0.1

159.0.1

Event History

Nov 3, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

MFSA2026-123

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2026-120572

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with low attack complexity and no privileges required, but user interaction is required. This suggests a user would need to interact with attacker-controlled content.

Which Firefox versions are known to be fixed?

The issue was fixed in Firefox 159.0.1. The provided data does not identify the first affected version or whether other Firefox release channels are affected.

What is the potential impact if exploitation succeeds?

The vulnerability is classified as a buffer overflow with high confidentiality, integrity, and availability impact in the provided CVSS vector. Successful exploitation could therefore affect data confidentiality, modify data, or disrupt availability.

CVE-2026-120572: Incorrect boundary conditions in the Layout: Block and Inline component

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Firefox versions are known to be fixed?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Firefox versions are known to be fixed?

What is the potential impact if exploitation succeeds?