CVE-2023-29542

What it actually does

A newline character embedded in a downloaded filename bypasses the extension-replacement logic that converts dangerous suffixes such as .lnk into .download, allowing the original malicious extension to remain intact on Windows.

Why it matters to the business

Users on Windows may inadvertently execute malware delivered through the browser because the file appears to have a safe extension, increasing the chance of credential theft, ransomware deployment, or persistent compromise.

How an attack unfolds

An attacker hosts a file whose name contains a newline followed by a dangerous extension such as .lnk, tricks a user into downloading it through an affected Firefox or Thunderbird instance on Windows, and relies on the unsanitized filename to survive so the user can double-click the file believing it is harmless.

How to fix it

Upgrade Firefox to 112 or later, Firefox ESR to 102.10 or later, and Thunderbird to 102.10 or later on all Windows systems. Until upgrades are complete, treat all downloads from untrusted sources with heightened scrutiny and consider disabling automatic opening of downloaded files.

How to confirm the fix worked

Verify that installed Firefox, Firefox ESR, and Thunderbird versions are at or above the fixed releases; confirm that filenames containing newlines are now correctly sanitized to .download on Windows.

Typical attack path

1. Attacker prepares a file with a newline and malicious extension in its name
2. Victim is induced to download the file via Firefox or Thunderbird on Windows
3. Browser fails to replace the extension because of the newline
4. File is saved with its original dangerous extension
5. User opens the file, executing attacker-controlled code

How to detect it

Examine browser download history and Windows file-system logs for entries whose original filenames contain newline characters or retain executable extensions after download; correlate with process-creation events for those files.

• filenames containing literal newline characters followed by .lnk, .exe, .scr or .bat
• download records in Firefox/Thunderbird history showing no .download suffix on Windows

What your security team should do

• Apply the version upgrades immediately across the Windows fleet
• Enable application allow-listing or script-blocking to limit execution of unexpected file types
• Review recent download logs for any files whose names contain newlines or retain .lnk/.exe extensions