CVE-2022-46874

What it actually does

Improper input validation when processing long filenames results in truncation that strips the legitimate extension and retains a malicious one, enabling execution of attacker-controlled code through user confusion.

Why it matters to the business

Users may inadvertently execute malware disguised as legitimate files, leading to potential compromise of endpoints, data theft, or further network intrusion across the organization.

How an attack unfolds

An attacker creates a file whose name is crafted to exceed length limits so that truncation removes the valid extension while preserving a malicious one; the file is delivered through web download or email attachment; the user, seeing a misleading extension, opens it and triggers code execution.

How to fix it

Upgrade Mozilla Firefox to 108 or later, Firefox ESR to 102.6 or later, and Thunderbird to 102.6.1 or later.

How to confirm the fix worked

Verify installed product versions against the fixed releases; attempt to save or open test files with long filenames containing multiple extensions and confirm correct extension handling.

Typical attack path

1. Craft file with excessively long filename ending in malicious extension
2. Deliver file via browser download or email
3. User views truncated name that hides the legitimate extension
4. User executes the file believing it is safe
5. Malicious code runs with user privileges

How to detect it

Review download and execution logs from browsers and email clients for files whose names were truncated or contained multiple extensions; correlate with subsequent process creation events.

What your security team should do

• Apply updates to all affected Mozilla products immediately
• Enforce application allow-listing to limit execution of unexpected file types
• Configure email and browser policies to warn on files with unusual extensions
• Monitor endpoint logs for processes launched from recently downloaded files