CVE-2023-32206VulnerabilityPublished 2 Jun 2023Updated 27 May 2025

CVE-2023-32206: Mozilla Firefox · Crash in RLBox Expat driver

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 or 102.11 when convenient.

Data as of 26 Oct 2026, 08:11 UTC

Severity

Medium

Rated Medium by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113, 102.11

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113 or 102.11.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113 <102.11	Fixed in 113 102.11

AI-suggested

Organizations should prioritize updating affected Mozilla products to the latest versions: Firefox 113 or later, Firefox ESR 102.11 or later, and Thunderbird 102.11 or later. Applying these updates will address the out-of-bound read vulnerability in the RLBox Expat driver. Beyond patching, organizations can implement input validation and filtering at network boundaries to block or sanitize potentially malicious XML content that could trigger the crash. Security teams should monitor application logs and user reports for signs of unexpected crashes that might indicate exploitation attempts or malformed content delivery. Deploying endpoint protection solutions that detect abnormal application behavior can help identify exploitation attempts early. For high-security environments, consider restricting the use of vulnerable versions of Firefox and Thunderbird until patches are applied. Finally, maintain regular vulnerability scanning and asset inventory to ensure all instances of these applications are identified and updated promptly.

Description

An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Impact

For European organizations, this vulnerability could lead to service disruptions if Firefox or Thunderbird clients crash unexpectedly. Organizations relying heavily on Firefox for web access or Thunderbird for email communications may experience reduced productivity or interruptions. In environments where these applications are used in critical workflows, such as government agencies, financial institutions, or healthcare providers, even temporary denial of service can have operational impacts. While this vulnerability does not directly expose sensitive data or allow remote code execution, the instability could be exploited by attackers to cause targeted disruptions or as part of multi-stage attacks. Additionally, organizations with strict uptime requirements or regulatory obligations for service availability may face compliance challenges if crashes occur frequently. The lack of known exploits reduces immediate risk, but the widespread use of Firefox and Thunderbird in Europe means that unpatched systems remain vulnerable to potential future exploitation or accidental crashes triggered by malformed XML content.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 02:57 UTC

Technical details

References

Community reviews

Related threats