CVE-2023-32206

What it actually does

Out-of-bounds read in the RLBox Expat XML parser driver causes a crash when processing specially crafted input.

Why it matters to the business

Users experience unexpected application crashes while browsing or reading email, leading to lost productivity and potential help-desk load; the flaw is not known to enable data theft or remote code execution.

How an attack unfolds

An attacker crafts a malicious XML document that triggers an out-of-bounds read inside the RLBox Expat driver; when the victim opens the document in an affected browser or email client the parser crashes, resulting in denial of service.

How to fix it

Upgrade Mozilla Firefox to version 113 or later, Firefox ESR to 102.11 or later, and Thunderbird to 102.11 or later.

How to confirm the fix worked

Inspect installed application versions against the fixed release numbers; confirm absence of the vulnerable RLBox Expat code path after upgrade.

Typical attack path

1. Deliver a malicious XML payload via web page, attachment, or email
2. Victim application invokes the RLBox Expat driver to parse the payload
3. Parser performs an out-of-bounds read and terminates
4. Application crashes, denying service to the user

How to detect it

Review application crash logs and telemetry for abrupt terminations during XML parsing; correlate timestamps with user reports of sudden browser or Thunderbird exits.

What your security team should do

• Apply the listed version upgrades within standard change windows
• Monitor vendor advisories for any subsequent back-port releases
• Include the affected products in routine vulnerability scanning