CVE-2016-2838

CVE-2016-2838 is a heap-based buffer overflow vulnerability in Mozilla Firefox versions prior to 48.0 and Firefox ESR 45.x before 45.3. This flaw, residing in the nsBidi::BracketData::AddOpening function, allows remote attackers to execute arbitrary code by crafting malicious SVG documents containing directional content. With a CVSS score of 8.8 (High), it presents a significant risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impact. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting limited real-world exploitation at the time of analysis.