PatchGap
Firefox · Graphics

CVE-2026-2806

Uninitialized Memory in Graphics
Low firefox Uninitialized Memory 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionUninitialized memory in the Graphics: Text component
ComponentGraphics
Bug ClassUninitialized Memory
Tracker2006199
Fix commit492000b51e30 (firefox) +10/-2
CISA KEVNot listed
CreditedZijie Zhao
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
gfx/thebes/gfxSVGGlyphs.cpp
 modified

Files Changed

  • gfx/tests/crashtests/2006199.html
  • gfx/tests/crashtests/badsvgfont.ttf
  • gfx/tests/crashtests/crashtests.list
  • gfx/thebes/gfxSVGGlyphs.cpp

Patch

view commit
diff --git a/gfx/tests/crashtests/2006199.html b/gfx/tests/crashtests/2006199.html
new file mode 100644
index 00000000000..d08d09a93a0
--- /dev/null
+++ b/gfx/tests/crashtests/2006199.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<style>
+@font-face {
+    font-family: 'PoCFont';
+    src: url('badsvgfont.ttf');
+}
+</style>
+<div style="font-family: PoCFont; font-size: 100px;">L</div>
diff --git a/gfx/tests/crashtests/badsvgfont.ttf b/gfx/tests/crashtests/badsvgfont.ttf
new file mode 100644
index 00000000000..b0b5be6ef88
Binary files /dev/null and b/gfx/tests/crashtests/badsvgfont.ttf differ
diff --git a/gfx/tests/crashtests/crashtests.list b/gfx/tests/crashtests/crashtests.list
index 8cd34acffd8..b44c8e47eec 100644
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -231,3 +231,4 @@ load 1938548.html
 load 1962172-1.html
 load 1983053.html
 load 1999841-1.html
+load 2006199.html
diff --git a/gfx/thebes/gfxSVGGlyphs.cpp b/gfx/thebes/gfxSVGGlyphs.cpp
index e9c3983a27e..dd76d27701c 100644
--- a/gfx/thebes/gfxSVGGlyphs.cpp
+++ b/gfx/thebes/gfxSVGGlyphs.cpp
@@ -281,8 +281,7 @@ gfxSVGGlyphsDocument::gfxSVGGlyphsDocument(const uint8_t* aBuffer,
       if (Z_OK == inflateInit2(&s, 16 + MAX_WBITS)) {
         int result = inflate(&s, Z_FINISH);
         if (Z_STREAM_END == result) {
-          MOZ_ASSERT(size_t(s.next_out - outBuf.Elements()) == origLen);
-          ParseDocument(outBuf.Elements(), outBuf.Length());
+          ParseDocument(outBuf.Elements(), s.total_out);
         } else {
           NS_WARNING("Failed to decompress SVG glyphs document");
         }
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/gfx/tests/crashtests/2006199.html b/gfx/tests/crashtests/2006199.html
new file mode 100644
index 00000000000..d08d09a93a0
--- /dev/null
+++ b/gfx/tests/crashtests/2006199.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<style>
+@font-face {
+    font-family: 'PoCFont';
+    src: url('badsvgfont.ttf');
+}
+</style>
+<div style="font-family: PoCFont; font-size: 100px;">L</div>
diff --git a/gfx/tests/crashtests/badsvgfont.ttf b/gfx/tests/crashtests/badsvgfont.ttf
new file mode 100644
index 00000000000..b0b5be6ef88
Binary files /dev/null and b/gfx/tests/crashtests/badsvgfont.ttf differ
diff --git a/gfx/tests/crashtests/crashtests.list b/gfx/tests/crashtests/crashtests.list
index 8cd34acffd8..b44c8e47eec 100644
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -231,3 +231,4 @@ load 1938548.html
 load 1962172-1.html
 load 1983053.html
 load 1999841-1.html
+load 2006199.html
Loading diff…
On This Page