CLSA-2026-1774366791 Fix CVE(s): CVE-2026-24484

SECURITY UPDATE: denial-of-service from nested multi-layer MVG-to-SVG conversions - debian/patches/CVE-2026-24484.patch: Throw VectorGraphicsNestedTooDeeply when vector-graphics nesting reaches MagickMaxRecursionDepth; fix crashes caused by unbounded nesting of graphic-context elements. -...

EUVD-2026-14865

Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox 149...

EUVD-2026-14841

Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox 149 and Firefox ESR 140.9...

EUVD-2026-14809

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9...

EUVD-2026-14829

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9...

EUVD-2026-14827

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9...

EUVD-2026-14845

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability affects Firefox 149 and Firefox ESR 140.9...

EUVD-2026-14853

Incorrect boundary conditions in the Graphics: Text component. This vulnerability affects Firefox 149 and Firefox ESR 140.9...

EUVD-2026-14831

Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox 149 and Firefox ESR 140.9...

EUVD-2026-14796

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9...

EUVD-2026-14792

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9...

EUVD-2026-14794

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9...

CVE-2026-33418

The CVE describes a vulnerability in @dicebear/converter.ensureSize() prior to v9.4.2, where a regex-based rewrite of SVG width/height capped at 2048px could be bypassed by crafting input that matches a non-root before the actual root. When such SVGs are rendered via @resvg/resvg-js on the Node....

CVE-2026-4725

Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

CVE-2026-4713

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4715

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4719

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4708

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4706

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4694

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...