CVE-2022-3266

What it actually does

Out-of-bounds read during H264 video decoding triggers a crash in the media processing pipeline.

Why it matters to the business

Users opening crafted video content in affected browsers or email clients experience application crashes, leading to denial of service and potential workflow disruption; the vulnerability is years old with negligible exploitation likelihood.

How an attack unfolds

An attacker creates a malformed H264 video stream that triggers an out-of-bounds read on decode; the victim opens the content through a web page or email attachment in an unpatched browser or client, causing an immediate crash that may be leveraged for further exploitation.

How to fix it

Upgrade Mozilla Firefox to version 105 or later, Firefox ESR to 102.3 or later, and Thunderbird to 102.3 or later.

How to confirm the fix worked

Confirm installed product versions meet or exceed the fixed releases; attempt playback of known trigger videos in a test environment and verify absence of crash.

Typical attack path

1. Craft malicious H264 video file
2. Host file on web server or attach to email
3. Trick victim into opening the content
4. Decoder performs out-of-bounds read and crashes

How to detect it

Review browser and system crash logs for media decoding failures around the time of suspected incidents; no widespread exploitation indicators exist given the low EPSS and lack of KEV listing.

What your security team should do

• Prioritize updating all Firefox, ESR, and Thunderbird instances to the fixed versions
• Block or sandbox untrusted video playback until patches are applied
• Monitor vendor advisories for any future related issues