High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Layout: Text and Fonts component
ComponentGraphics
Bug ClassLogic Error
Tracker2074167
Fix commitd8b0cd3f8ed3 (firefox) +3/-1
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-27

Files Changed

  • gfx/thebes/gfxSVGGlyphs.cpp
diff --git a/gfx/thebes/gfxSVGGlyphs.cpp b/gfx/thebes/gfxSVGGlyphs.cpp
index b5894c1e402..d2bad1d3495 100644
--- a/gfx/thebes/gfxSVGGlyphs.cpp
+++ b/gfx/thebes/gfxSVGGlyphs.cpp
@@ -118,7 +118,9 @@ gfxSVGGlyphsDocument* gfxSVGGlyphs::FindOrCreateGlyphsDocument(
     auto doc = MakeUnique<gfxSVGGlyphsDocument>(
         data + mHeader->mDocIndexOffset + entry->mDocOffset, entry->mDocLength,
         this);
-    return mGlyphDocs.InsertOrUpdate(entry->mDocOffset, std::move(doc)).get();
+    // Similarly to the Lookup() call above, if we've already created a separate
+    // document, keep it rather than overriding it.
+    return mGlyphDocs.LookupOrInsert(entry->mDocOffset, std::move(doc)).get();
   }
 
   return nullptr;
Loading diff…