Log in Start free

Actively exploited · Published Dec 22, 2022 · Assigned by mozilla

CVE-2022-26485

High 8.8 Exploited

In plain English

A high-severity use-after-free in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2022). The chance it is exploited in the next 30 days is estimated at 14.3% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)14.3%top 3.4% of all CVEs
Exploited in the wildYesCISA KEV since Mar 7, 2022
Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 21, 2022.

Official description

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox91.7.0-3.el8_5.almaALSA-2022:0818
AlmaLinux:8thunderbird91.7.0-2.el8_5.almaALSA-2022:0845
AlmaLinux:8thunderbird91.7.0-2.el8_5.alma.plusALSA-2022:0845
Alpine:v3.20firefox97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.21firefox97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.22firefox97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.23firefox97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.20firefox-esr91.6.1-r0ALPINE-CVE-2022-26485
Alpine:v3.21firefox-esr91.6.1-r0ALPINE-CVE-2022-26485
Alpine:v3.22firefox-esr91.6.1-r0ALPINE-CVE-2022-26485
Alpine:v3.23firefox-esr91.6.1-r0ALPINE-CVE-2022-26485
Alpine:v3.21librewolf97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.22librewolf97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.23librewolf97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.24librewolf97.0.2-r0ALPINE-CVE-2022-26485
Alpine:v3.20thunderbird91.6.2-r0ALPINE-CVE-2022-26485
Alpine:v3.21thunderbird91.6.2-r0ALPINE-CVE-2022-26485
Alpine:v3.22thunderbird91.6.2-r0ALPINE-CVE-2022-26485
Alpine:v3.23thunderbird91.6.2-r0ALPINE-CVE-2022-26485
Debian:12firefox-esr91.6.1esr-1DEBIAN-CVE-2022-26485
Debian:13firefox-esr91.6.1esr-1DEBIAN-CVE-2022-26485
Debian:14firefox-esr91.6.1esr-1DEBIAN-CVE-2022-26485
Debian:12thunderbird1:91.6.2-1DEBIAN-CVE-2022-26485
Debian:13thunderbird1:91.6.2-1DEBIAN-CVE-2022-26485
Debian:14thunderbird1:91.6.2-1DEBIAN-CVE-2022-26485
Rocky Linux:8firefox0:91.7.0-3.el8_5RLSA-2022:0818
Rocky Linux:8thunderbird0:91.7.0-2.el8_5RLSA-2022:0845
Ubuntu:22.04:LTSfirefox1:1snap1-0ubuntu1UBUNTU-CVE-2022-26485

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 97.0.2
Mozilla Firefox ESR unspecified – before 91.6.1
Mozilla Firefox for Android unspecified – before 97.3.0
Mozilla Thunderbird unspecified – before 91.6.2
Mozilla Focus unspecified – before 97.3.0

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References