CVE-2023-5168

What it actually does

Out-of-bounds write in a privileged process triggered by malicious data supplied to FilterNodeD2D1 from a compromised content process, affecting only Windows builds and enabling potential code execution outside the sandbox.

Why it matters to the business

Attackers can achieve remote code execution within the browser's privileged process on Windows systems, risking theft of credentials, session data, and further lateral movement; the vulnerability remains relevant given its critical severity and modest but increasing exploitation probability.

How an attack unfolds

An attacker first compromises the renderer/content process through a separate vector, crafts malicious data targeting FilterNodeD2D1, and supplies it to trigger an out-of-bounds write that leads to an exploitable condition in the privileged process; similar patterns have been observed in related graphics library issues exploited by advanced actors.

How to fix it

Upgrade Firefox to version 118 or later, Firefox ESR to 115.3 or later, and Thunderbird to 115.3 or later; apply updates immediately on Windows systems given the critical CVSS rating and rising EPSS trend.

How to confirm the fix worked

Verify installed versions against the fixed releases (Firefox >= 118, ESR >= 115.3, Thunderbird >= 115.3); inspect about:support or equivalent for build information and confirm absence of the vulnerable FilterNodeD2D1 code path through updated binaries.

Typical attack path

1. Compromise the content/renderer process via web content or extension
2. Craft and deliver malicious data to FilterNodeD2D1
3. Trigger out-of-bounds write resulting in privileged process crash
4. Achieve code execution outside the sandbox on Windows

How to detect it

Search application and system logs for Firefox or Thunderbird crashes involving FilterNodeD2D1 or graphics-related modules; correlate with unexpected privileged process terminations or sandbox escapes on Windows endpoints.

What your security team should do

• Prioritize patching all Windows Firefox, ESR, and Thunderbird instances within the next 48 hours due to critical severity and EPSS increase
• Enforce automatic updates and monitor enterprise deployment dashboards for version compliance
• Review Windows-specific browser policies to restrict unnecessary privileges until patches are applied