All vulnerabilities
CVE-2022-26485

Mozilla Firefox Use-After-Free Vulnerability

Mozilla FirefoxApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 7 Mar 2022CISA KEV
Exploit odds (EPSS)14.3%Chance of exploitation activity in the next 30 days, higher than 96% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in97.0.2Also 91.6.1, 97.3.0 and 1 moreCVE List
Federal deadline21 Mar 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 7 Mar 2022Added to CISA KEVCISA KEV
  2. 22 Dec 2022, 00:00 UTCPublishedCVE List

Description

Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

Text from CVE List

Affected versions 5

  • Firefoxaffected: unspecified before 97.0.2CVE List
  • Firefox ESRaffected: unspecified before 91.6.1CVE List
  • Firefox for Androidaffected: unspecified before 97.3.0CVE List
  • Thunderbirdaffected: unspecified before 91.6.2CVE List
  • Focusaffected: unspecified before 97.3.0CVE List

References 4