CVE-2023-32216VulnerabilityPublished 19 Jun 2023Updated 27 May 2025

CVE-2023-32216: Memory safety bugs fixed in Firefox 113

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 soon.

Data as of 25 Oct 2026, 19:02 UTC

Severity

High

Rated High by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113	Fixed in 113

AI-suggested

Organizations should prioritize updating all Firefox installations to version 113 or later to remediate these memory safety vulnerabilities. Beyond patching, it is advisable to implement browser security best practices such as enabling automatic updates to ensure timely application of future patches. Employing endpoint protection solutions that monitor for anomalous behavior or exploit attempts targeting browsers can provide additional defense layers. Network-level controls like web filtering and sandboxing can reduce exposure to malicious web content that might trigger such vulnerabilities. For high-risk environments, consider restricting the use of Firefox to trusted users or deploying hardened browser configurations with reduced privileges and disabled unnecessary features. Regular vulnerability scanning and asset inventory management will help identify outdated Firefox versions across the organization. Finally, user awareness training about phishing and malicious websites can reduce the likelihood of exploitation through social engineering vectors.

Description

Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113.

Impact

For European organizations, the impact of CVE-2023-32216 could be substantial due to Firefox's widespread adoption across government, corporate, and private sectors. Successful exploitation could lead to arbitrary code execution, enabling attackers to bypass security controls, exfiltrate sensitive data, or deploy malware within organizational networks. This is particularly critical for sectors handling sensitive personal data under GDPR regulations, such as finance, healthcare, and public administration. Additionally, compromised browsers could serve as entry points for broader network intrusions or lateral movement within enterprise environments. The absence of known exploits currently limits immediate widespread impact, but unpatched systems remain vulnerable to targeted attacks or future exploit development. Given the browser's role as a primary interface to the internet, the threat extends to all organizations relying on Firefox for daily operations, increasing the risk of data breaches, operational disruption, and reputational damage.

Summary

CVE-2023-32216 is a set of memory safety vulnerabilities identified in Mozilla Firefox versions prior to 113. These bugs were reported by Mozilla developers and the Mozilla Fuzzing Team, indicating issues related to memory corruption. Memory safety bugs typically involve errors such as buffer overflows, use-after-free, or other forms of memory mismanagement that can lead to unpredictable behavior. In this case, the vulnerabilities were found in Firefox 112 and earlier versions. Although no public exploits have been observed in the wild, the presence of memory corruption suggests that with sufficient effort, attackers could potentially exploit these bugs to execute arbitrary code within the context of the browser. This could allow attackers to compromise the confidentiality, integrity, and availability of the affected system by running malicious code, stealing sensitive information, or causing crashes. The vulnerabilities affect all Firefox versions before 113, and the fixes were incorporated starting with Firefox 113. No CVSS score has been assigned yet, but the nature of memory corruption vulnerabilities in a widely used browser like Firefox makes this a significant security concern. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially given the browser's extensive use for web access and the potential for drive-by attacks or malicious web content to trigger these bugs.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 03:10 UTC

Technical details

References

Community reviews

Related threats