CVE-2016-9079
High 7.5 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Metrics
- CVSS 3.1
-
7.5 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 87% (percentile: 100) as of 1 November 2026
- CWE
- CWE-416
Affected products
debian: debian linux; redhat: enterprise linux; redhat: enterprise linux desktop; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server eus; redhat: enterprise linux workstation; mozilla: thunderbird; microsoft: windows; mozilla: firefox; torproject: tor
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066 ExploitIssue TrackingVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-92/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066 ExploitIssue TrackingVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-92/ Vendor Advisory
- https://www.exploit-db.com/exploits/41151/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42327/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41151/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42327/ ExploitThird Party AdvisoryVDB Entry
- http://rhn.redhat.com/errata/RHSA-2016-2843.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2850.html Third Party Advisory