CVE-2023-32214VulnerabilityPublished 19 Jun 2023Updated 27 May 2025

CVE-2023-32214: Mozilla Firefox · Potential DoS via exposed protocol handlers

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 or 102.11 when convenient.

Data as of 26 Oct 2026, 06:26 UTC

Severity

Medium

Rated Medium by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.9% chance of exploitation in 30 days – higher than 59% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113, 102.11

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113 or 102.11.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113 <102.11	Fixed in 113 102.11

AI-suggested

To mitigate this vulnerability, European organizations should prioritize upgrading affected Mozilla products to Firefox 113 or later, Firefox ESR 102.11 or later, and Thunderbird 102.11 or later. This is the most effective and direct mitigation. Additionally, organizations should implement endpoint protection measures that can detect and block suspicious URL schemes or protocol handler invocations, especially those involving 'ms-cxh' and 'ms-cxh-full'. Security awareness training should emphasize caution when clicking on unknown or suspicious links, as user interaction is required to trigger the vulnerability. Network-level controls such as web filtering can be configured to block or monitor URLs that attempt to invoke these protocol handlers. For organizations with strict availability requirements, consider deploying application whitelisting or sandboxing techniques to isolate browser and email client processes, limiting the impact of potential crashes. Monitoring application logs for abnormal crashes related to protocol handlers can help detect exploitation attempts. Finally, maintain up-to-date vulnerability management processes to ensure timely application of patches as they become available.

Description

Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Impact

For European organizations, this vulnerability poses a risk primarily to Windows users running affected versions of Firefox or Thunderbird. The impact is a denial of service, which could disrupt business operations by causing browser or email client crashes, leading to loss of productivity and potential interruption of critical communications. While the vulnerability does not lead to remote code execution or data breach directly, denial of service attacks can be leveraged as part of larger attack campaigns or to cause targeted disruption. Organizations relying heavily on Firefox or Thunderbird on Windows endpoints, especially in sectors where availability is critical (e.g., finance, government, healthcare), could experience operational disturbances. Additionally, since the attack requires user interaction, phishing or social engineering campaigns could be used to exploit this vulnerability. The lack of known exploits in the wild reduces immediate risk, but the presence of publicly available vulnerability information increases the likelihood of future exploitation attempts. Therefore, European organizations should consider this vulnerability a moderate operational risk that could be exploited to degrade service availability.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 03:10 UTC

Technical details

References

Community reviews

Related threats