CVE-2022-45405

What it actually does

Use-after-free condition triggered by freeing nsIInputStream objects on a thread different from their creation thread, resulting in memory corruption and potential exploitable crash.

Why it matters to the business

Remote denial-of-service crashes or potential code execution on affected browser and email clients, increasing risk of user system compromise and operational disruption; low EPSS and no known exploitation reduce immediate urgency despite 1395 days since publication.

How an attack unfolds

An attacker supplies specially crafted content that causes an nsIInputStream to be freed on an incorrect thread; subsequent access on the original thread triggers the use-after-free, enabling memory manipulation for crash or exploitation.

How to fix it

Upgrade affected Firefox ESR to 102.5 or later, Thunderbird to 102.5 or later, and Firefox to 107 or later; for tensorflow/tensorflow (GIT) apply the fix in commit bd90b3efab4ec958b228cd7cfe9125be1c0cf255.

How to confirm the fix worked

Confirm product versions meet or exceed the listed fixed releases and test that input stream handling no longer occurs across threads in multi-threaded scenarios.

Typical attack path

1. Deliver malicious web page or email attachment to victim
2. Trigger input stream creation and cross-thread free operation
3. Force use of the now-freed stream object
4. Leverage resulting memory corruption for code execution or denial of service

How to detect it

Review browser crash logs and process dumps for nsIInputStream related use-after-free signatures; correlate with web or email content delivery events.

What your security team should do

• Prioritize patching browser and email clients to the stated fixed versions
• Monitor for any new exploit maturity signals given the +3% EPSS trend
• Apply the tensorflow commit bd90b3efab4ec958b228cd7cfe9125be1c0cf255 where that package is in use