CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerability

Published Mar 5, 2022
·
Updated

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw.

Other sources

As per Mozilla Security Advisory: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.

Reporter: Wang Gang, Liu Jialei, Du Sihang, Huang Yi & Yang Kang of 360 ATA Name: the Mozilla project

Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/#CVE-2022-26485

— Red Hat

Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

— CISA

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Affected Software

66 affected componentsFixes available
redhat/firefox<0:91.7.0-3.el7_9
0:91.7.0-3.el7_9
redhat/thunderbird<0:91.7.0-2.el7_9
0:91.7.0-2.el7_9
redhat/firefox<0:91.7.0-3.el8_5
0:91.7.0-3.el8_5
redhat/thunderbird<0:91.7.0-2.el8_5
0:91.7.0-2.el8_5
redhat/firefox<0:91.7.0-3.el8_1
0:91.7.0-3.el8_1
redhat/thunderbird<0:91.7.0-2.el8_1
0:91.7.0-2.el8_1
redhat/firefox<0:91.7.0-3.el8_2
0:91.7.0-3.el8_2
redhat/thunderbird<0:91.7.0-2.el8_2
0:91.7.0-2.el8_2
redhat/firefox<0:91.7.0-3.el8_4
0:91.7.0-3.el8_4
redhat/thunderbird<0:91.7.0-2.el8_4
0:91.7.0-2.el8_4
Mozilla Firefox<97.0.2
97.0.2
Mozilla Firefox ESR<91.6.1
91.6.1
All of the following
Mozilla Firefox=97.3
Google Android
Mozilla Focus<97.3
97.3
Mozilla Thunderbird<91.6.2
91.6.2
Mozilla Firefox<97.0.2
Mozilla Firefox Android<97.3.0
Mozilla Firefox ESR<91.6.1
Mozilla Firefox Focus<97.3.0
Mozilla Thunderbird<91.6.2
redhat/firefox<97.0.2
97.0.2
redhat/firefox esr<91.6.1
91.6.1
redhat/thunderbird<91.6.2
91.6.2
Mozilla Firefox<91.6.1
Mozilla Firefox<97.0.2
Mozilla Firefox Mobile Android<97.3.0
Mozilla Firefox
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox<97.0.2-r0
97.0.2-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/firefox-esr<91.6.1-r0
91.6.1-r0
alpine/librewolf<97.0.2-r0
97.0.2-r0
alpine/librewolf<97.0.2-r0
97.0.2-r0
alpine/librewolf<97.0.2-r0
97.0.2-r0
alpine/librewolf<97.0.2-r0
97.0.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
alpine/thunderbird<91.6.2-r0
91.6.2-r0
debian/firefox-esr<91.6.1esr-1
91.6.1esr-1
debian/firefox-esr<91.6.1esr-1
91.6.1esr-1
debian/firefox-esr<91.6.1esr-1
91.6.1esr-1
debian/thunderbird<1:91.6.2-1
1:91.6.2-1
debian/thunderbird<1:91.6.2-1
1:91.6.2-1
debian/thunderbird<1:91.6.2-1
1:91.6.2-1
debian/firefox
160.0-1
debian/firefox-esr
140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1
debian/thunderbird
1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el7_9
  2. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el7_9
  3. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_5
  4. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_5
  5. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_1
  6. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_1
  7. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_2
  8. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_2
  9. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_4
  10. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_4
  11. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  12. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  13. Upgrade

    Upgrade Mozilla Focus to a version that resolves this vulnerability.

    Fixed in 97.3
  14. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2
  15. Upgrade

    Upgrade redhat/Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  16. Upgrade

    Upgrade redhat/Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  17. Upgrade

    Upgrade redhat/Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2
  18. Upgrade

    Upgrade alpine/firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2-r0
  19. Upgrade

    Upgrade alpine/firefox-esr to a version that resolves this vulnerability.

    Fixed in 91.6.1-r0
  20. Upgrade

    Upgrade alpine/librewolf to a version that resolves this vulnerability.

    Fixed in 97.0.2-r0
  21. Upgrade

    Upgrade alpine/thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2-r0
  22. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 91.6.1esr-1
  23. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:91.6.2-1
  24. Upgrade

    Upgrade debian/firefox to a version that resolves this vulnerability.

    Fixed in 160.0-1
  25. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
  26. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
  27. Upgrade

    Upgrade Mozilla Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  28. Upgrade

    Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  29. Upgrade

    Upgrade Mozilla Firefox for Android to a version that resolves this vulnerability.

    Fixed in 97.3.0
  30. Upgrade

    Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2
  31. Upgrade

    Upgrade Mozilla Focus to a version that resolves this vulnerability.

    Fixed in 97.3.0

Event History

Mar 5, 2022
CVE Published
12:00 AM
Mar 7, 2022
Data Sourced
via CISA·12:00 AM
DescriptionWeaknessAffected Software
Mar 8, 2022
Data Sourced
via Red Hat·01:14 PM
DescriptionSeverityAffected Software
Dec 22, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·08:15 PM
DescriptionSeverityAffected Software
Jan 31, 2023
Exploit Published
via GitHub·09:01 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2022-26485?

CVE-2022-26485 is a use-after-free vulnerability affecting Mozilla Firefox, Firefox ESR, Firefox for Android, Thunderbird, and Focus.

2

How severe is CVE-2022-26485?

CVE-2022-26485 has a severity score of 8.8 (critical).

3

Which versions of Firefox are affected by CVE-2022-26485?

Firefox versions prior to 97.0.2 are affected by CVE-2022-26485.

4

How can I fix CVE-2022-26485?

To fix CVE-2022-26485, update Firefox to version 97.0.2 or later.

5

Are there any references for CVE-2022-26485?

Yes, you can find references for CVE-2022-26485 in the following links: [link1](https://www.cve.org/CVERecord?id=CVE-2022-26485), [link2](https://nvd.nist.gov/vuln/detail/CVE-2022-26485), [link3](https://bugzilla.redhat.com/show_bug.cgi?id=2061736), [link4](https://access.redhat.com/errata/RHSA-2022:0824).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203