CVE-2023-37208

What it actually does

The application fails to present a security warning when a user opens .diagcab files, allowing potentially malicious cabinet files containing executable code to be processed without user notification.

Why it matters to the business

Organizations face increased risk of endpoint compromise when users interact with .diagcab files distributed via email or web downloads, potentially leading to unauthorized code execution and data loss.

How an attack unfolds

An attacker creates a malicious .diagcab archive containing harmful payloads and delivers it through web content or attachments; when a user opens the file in an affected browser or client, the absence of a warning allows the code to execute with the user's privileges.

How to fix it

Upgrade affected installations to the fixed commit c9aeccb2ab260ceedc126e6e366da8cd13ece4b2 or later; apply vendor patches for Firefox 115+, ESR 102.13+, and Thunderbird 102.13+ where applicable.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed commit or listed releases; test opening sample .diagcab files to verify warning behavior is restored.

Typical attack path

1. Attacker crafts malicious .diagcab file with embedded code
2. Attacker hosts or sends the file via web page, email, or download link
3. Victim opens the .diagcab file using the vulnerable application
4. No security prompt is shown, allowing payload execution
5. Attacker gains code execution on the endpoint

How to detect it

Review application logs and file-open events for .diagcab usage; correlate with unexpected process spawns or network activity following cabinet file access.

What your security team should do

• Prioritize patching all instances to the fixed commit or newer releases within standard change windows
• Monitor for .diagcab file handling events in endpoint logs
• Educate users on risks of opening cabinet files from untrusted sources until patches are deployed