CVE-2023-4573

What it actually does

Use-after-free in IPC mStream handling during rendering data initialization allows a destroyed object to be accessed, resulting in a crash with potential for arbitrary code execution.

Why it matters to the business

Attackers can trigger browser or email client crashes, disrupting user operations and potentially enabling remote code execution on affected systems; high ecosystem prevalence of Mozilla products amplifies exposure risk despite low EPSS and no KEV listing.

How an attack unfolds

An attacker crafts malicious rendering data sent over IPC to Firefox or Thunderbird; the mStream object is destroyed during initialization, and subsequent access triggers the use-after-free leading to a crash that may be exploitable for code execution. No named threat actors are associated with this specific CVE.

How to fix it

Upgrade Firefox to version 117 or later, Firefox ESR to 102.15 or 115.2 or later, and Thunderbird to 102.15 or 115.2 or later. Apply updates immediately given the 1122 days since publication.

How to confirm the fix worked

Verify installed product versions against the fixed releases listed in remediation; test rendering IPC paths with known-safe data to confirm absence of crash behavior.

Typical attack path

1. Identify target running vulnerable Firefox or Thunderbird version
2. Send specially crafted IPC rendering data to the application
3. Trigger mStream destruction during initialization
4. Force subsequent use of the freed object to induce crash or exploitation

How to detect it

Review application crash logs for mStream-related use-after-free signatures; correlate with IPC rendering events in browser process telemetry. No ransomware or KEV campaigns noted.

What your security team should do

• Prioritize patching all Mozilla Firefox and Thunderbird instances to the fixed versions
• Monitor EPSS and threat intelligence feeds for any future exploitation activity despite current low score
• Enforce application allow-listing and sandboxing to limit impact of potential crashes