CVE-2016-1960

CVE-2016-1960 describes an integer underflow vulnerability within the nsHtml5TreeBuilder class of Mozilla Firefox's HTML5 string parser, affecting Firefox before version 45.0 and Firefox ESR 38.x before 38.7, as well as products from OpenSUSE, Oracle, and SUSE. This flaw allows remote attackers to achieve arbitrary code execution or cause a denial-of-service via a use-after-free condition by manipulating end tags, particularly in SVG processing. Rated with a CVSS score of 8.8 (High), the vulnerability has a network attack vector, low attack complexity, and high potential impact on confidentiality, integrity, and availability, requiring user interaction. While not listed on CISA's KEV catalog, exploit code exists on ExploitDB, and it has garnered significant community discussion and media coverage, indicating its past relevance and potential for exploitation.