CVE-2010-1028: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 8.7% chance of exploitation in the next 30 days.

Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0.

Affected products

• Mozilla Firefox: version 3.6 only; version 3.6.1 only; version 3.7 only

Published 2010-03-19. Last modified 2026-06-16.