CVE-2022-38478

What it actually does

Memory safety bugs resulting in memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Attackers could gain full control of user systems running affected browsers or email clients, enabling data theft, malware deployment, or further network compromise across a widely deployed software ecosystem.

How an attack unfolds

An attacker crafts malicious web content or email that triggers one of the memory corruption conditions during parsing or rendering, allowing control of the instruction pointer and execution of attacker-supplied code.

How to fix it

Upgrade Firefox to 104 or later, Firefox ESR to 91.13 or 102.2 or later, and Thunderbird to 91.13 or 102.2 or later. Remove unsupported older releases from the environment.

How to confirm the fix worked

Confirm product versions meet or exceed the fixed releases listed above; retest affected functionality with memory-safety tooling where feasible.

Typical attack path

1. Serve malicious webpage or email attachment to target
2. Victim renders content in vulnerable Firefox, ESR, or Thunderbird
3. Memory corruption occurs and is exploited to gain code execution
4. Attacker payload executes to install malware or exfiltrate data

How to detect it

Examine browser and email-client crash logs, process memory dumps, and execution traces around the time of rendering untrusted content for signs of unexpected code paths or injected payloads.

What your security team should do

• Immediately deploy the fixed versions to all endpoints
• Block legacy vulnerable releases via software inventory or policy
• Monitor crash reports and endpoint telemetry for suspicious memory activity