CVE-2021-29980

What it actually does

Uninitialized memory in a canvas object triggers an incorrect free() operation, resulting in memory corruption that can lead to a crash or arbitrary code execution.

Why it matters to the business

Attackers could gain control of affected browsers or email clients, risking theft of user data, credential compromise, or further network intrusion; the issue has been public for over five years with public exploits available.

How an attack unfolds

An attacker crafts a malicious webpage or HTML email containing a specially prepared canvas element. When the victim loads the content in an unpatched Firefox, Firefox ESR, or Thunderbird, the uninitialized memory is freed incorrectly, corrupting heap structures and allowing the attacker to hijack control flow.

How to fix it

Upgrade Firefox to version 91 or later, Firefox ESR to 78.13 or later, and Thunderbird to 78.13 or 91 or later. Apply vendor updates as soon as possible given the age of the vulnerability and public exploit availability.

How to confirm the fix worked

Verify installed product versions against the fixed releases listed in Mozilla security advisories; re-test affected canvas rendering paths after upgrade to confirm the crash no longer occurs.

Typical attack path

1. Deliver malicious HTML via web page or email attachment to the target user
2. Victim's browser or email client renders the canvas object
3. Uninitialized memory triggers incorrect free leading to heap corruption
4. Attacker uses corruption to achieve code execution or reliable crash
5. Payload executes within the browser or Thunderbird process context

How to detect it

Review application crash logs and telemetry for unexpected terminations involving canvas or memory-management routines; correlate with web or email access to suspicious domains around the time of the crash.

What your security team should do

• Immediately inventory all Firefox, Firefox ESR, and Thunderbird deployments and prioritize patching
• Block or sandbox untrusted web and email content until updates are applied
• Monitor vendor advisories for any related memory-safety improvements
• Educate users on avoiding suspicious links and attachments