CVE-2022-46881: mozilla firefox Out-of-bounds Write
Vulnerability summary
CVE-2022-46881 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in mozilla firefox. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 28 · Related 6Timeline
- 22-12-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
+0.02 pp
From 0.72% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla3 products
- firefox≥ unspecified, < 106 | < 106.0
- firefox_esr≥ unspecified, < 102.6 | < 102.6
- thunderbird≥ unspecified, < 102.6 | < 102.6
Debian2 products
- firefox-esr< 102.6.0esr-1
- thunderbird< 1:102.6.0-1
Ubuntu1 product
- thunderbird< 1:102.7.1+build2-0ubuntu0.18.04.1 | < 1:102.7.1+build2-0ubuntu0.20.04.1 | < 1:102.7.1+build2-0ubuntu0.22.04.1
3 vendors · 6 products
References
12 links- security.gentoo.org/glsa/202305-06Vendor Advisory
- security.gentoo.org/glsa/202305-13Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2022-44/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2022-52/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2022-53/Vendor Advisory
