CVE-2021-43537

What it actually does

Incorrect 64-bit to 32-bit integer type conversion in memory handling allows out-of-bounds writes, resulting in memory corruption that can lead to crashes or arbitrary code execution.

Why it matters to the business

Users of affected browsers and email clients face risk of remote compromise, data theft, or service disruption when visiting malicious sites, increasing incident response costs and potential regulatory exposure for organizations relying on these products.

How an attack unfolds

An attacker hosts a specially crafted web page or email that triggers the faulty size conversion during rendering or parsing; the resulting memory corruption is leveraged to execute attacker-controlled code within the browser process.

How to fix it

Upgrade Mozilla Firefox to version 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later; apply vendor updates as soon as available across all deployments.

How to confirm the fix worked

Verify installed versions against the fixed thresholds (Firefox >=95, ESR >=91.4.0, Thunderbird >=91.4.0) and confirm absence of the vulnerable code paths through binary or package inspection.

Typical attack path

1. Attacker prepares malicious webpage or email content exploiting the type conversion flaw
2. Victim loads the content in a vulnerable browser or Thunderbird instance
3. Memory corruption occurs during size handling
4. Attacker chains corruption to achieve code execution or crash

How to detect it

Review browser crash logs and memory dumps for patterns consistent with size-conversion failures; correlate with web proxy logs showing visits to previously unknown or suspicious domains around the time of any anomalous browser terminations.

What your security team should do

• Immediately prioritize browser and email client updates enterprise-wide
• Monitor EPSS trend for any future rise and reassess patching urgency
• Enforce application allow-listing and web isolation for high-risk users until patches are deployed