CVE-2023-32215VulnerabilityPublished 2 Jun 2023Updated 27 May 2025

CVE-2023-32215: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 or 102.11 soon.

Data as of 26 Oct 2026, 06:26 UTC

Severity

High

Rated High by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113, 102.11

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113 or 102.11.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113 <102.11	Fixed in 113 102.11

AI-suggested

European organizations should prioritize updating all Firefox and Thunderbird installations to versions 113 and 102.11 ESR or later, respectively. This is the most effective mitigation as it directly addresses the memory safety bugs. Organizations should implement automated patch management processes to ensure timely deployment of these updates across all endpoints. Additionally, user awareness training should emphasize caution with unsolicited emails and suspicious websites to reduce the risk of exploitation via social engineering. Network-level protections such as web filtering and email security gateways can help block access to malicious content that might exploit these vulnerabilities. Endpoint detection and response (EDR) solutions should be tuned to detect anomalous behaviors indicative of exploitation attempts. Organizations should also review and restrict browser and email client privileges to limit the potential impact of a successful exploit. Finally, maintaining regular backups and incident response plans will help mitigate damage in case of compromise.

Description

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Impact

For European organizations, the impact of CVE-2023-32215 could be substantial due to the widespread use of Firefox and Thunderbird in both private and enterprise environments. Successful exploitation could lead to arbitrary code execution, allowing attackers to compromise user systems, steal sensitive data, or move laterally within corporate networks. This is particularly concerning for organizations handling sensitive personal data under GDPR regulations, as a breach could lead to regulatory penalties and reputational damage. The vulnerability could be exploited via malicious websites or email attachments, making phishing campaigns a likely attack vector. Given the critical role of browsers and email clients in daily operations, exploitation could disrupt business continuity and lead to significant incident response costs. Furthermore, since no known exploits are currently in the wild, organizations have a window of opportunity to patch before active exploitation begins, but failure to act promptly could increase risk exposure.

Summary

CVE-2023-32215 is a set of memory safety vulnerabilities identified in Mozilla Firefox versions prior to 113 and Firefox ESR versions prior to 102.11, as well as Thunderbird versions prior to 102.11. These bugs were discovered and reported by Mozilla developers and the Mozilla Fuzzing Team. The vulnerabilities involve memory corruption issues, which are critical because they can lead to undefined behavior such as use-after-free, buffer overflows, or other memory mismanagement errors. Such memory safety bugs can be exploited by attackers to execute arbitrary code within the context of the affected application. This means an attacker could potentially run malicious code on a victim's machine by tricking them into visiting a specially crafted website or opening a malicious email in Thunderbird. Although no known exploits are currently reported in the wild, the presence of memory corruption evidence suggests that with sufficient effort, these vulnerabilities could be weaponized. The vulnerabilities affect widely used versions of Firefox and Thunderbird, which are popular browsers and email clients, respectively. The lack of a CVSS score indicates that the severity has not been formally assessed, but the nature of memory corruption vulnerabilities in a widely deployed client software implies a significant security risk. The fixes were released in Firefox 113 and Firefox ESR 102.11, so updating to these or later versions is critical to mitigate the risk.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 03:10 UTC

Technical details

References

Community reviews

Related threats