CVE-2022-26485
published 2022-12-22CVE-2022-26485: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw…
PriorityP183high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-03-21
Exploited in the wild
EPSS
14.26%
96.2th percentile
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 99.0-1 (sid) | firefox 99.0-1 (sid) |
| debian | firefox-esr | < firefox 99.0-1 (sid) | firefox 99.0-1 (sid) |
| debian | thunderbird | < firefox 99.0-1 (sid) | firefox 99.0-1 (sid) |
| mozilla | firefox | < 91.6.1 | 91.6.1 |
| mozilla | firefox | < 97.0.2 | 97.0.2 |
| mozilla | firefox | < 97.3.0 | 97.3.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 97.0.2+build1-0ubuntu0.18.04.1 | 97.0.2+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 97.0.2+build1-0ubuntu0.20.04.1 | 97.0.2+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 97.0.2 | 97.0.2 |
| mozilla | firefox_esr | >= unspecified < 91.6.1 | 91.6.1 |
| mozilla | firefox_focus | < 97.3.0 | 97.3.0 |
| mozilla | firefox_for_android | >= unspecified < 97.3.0 | 97.3.0 |
| mozilla | focus | >= unspecified < 97.3.0 | 97.3.0 |
| mozilla | thunderbird | < 91.6.2 | 91.6.2 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1~deb11u1 | 1:91.6.2-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1 | 1:91.6.2-1 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1 | 1:91.6.2-1 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1 | 1:91.6.2-1 |
| mozilla | thunderbird | >= unspecified < 91.6.2 | 91.6.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit triggers a heap-use-after-free in txVariable::Convert (txMozillaXSLTProcessor.cpp:1361) by calling XSLTProcessor.removeParameter() from within a Symbol.toPrimitive callback during transformToDocument execution. Detect JavaScript that creates an XSLTProcessor, sets a parameter with an object having a custom [Symbol.toPrimitive] that calls removeParameter(), then calls transformToDocument(). ↗
- →The PoC exploit pattern involves: (1) new XSLTProcessor(), (2) setParameter() with an object whose Symbol.toPrimitive calls removeParameter(), (3) transformToDocument(). Monitor for this JS API call sequence in browser telemetry or content process sandboxing logs. ↗
- →This vulnerability is confirmed exploited in the wild (CISA KEV). Prioritize detection on Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. ↗
- →The exploit type is classified as Render RCE, meaning exploitation occurs in the renderer/content process. Sandbox escape may follow; monitor for unexpected child process spawning from firefox.exe or thunderbird.exe renderer processes. ↗
- ·The Bugzilla PoC is a minimal proof-of-concept (MINIPOC) demonstrating the UAF trigger; real in-the-wild exploits likely use obfuscated or more complex variants of this JS pattern. ↗
- ·Red Hat Enterprise Linux 9 packages for firefox and thunderbird are listed as 'Not affected', so detection/patching priority should focus on RHEL 6/8 and other affected platforms. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Mozilla Firefox Use-After-Free Vulnerability
cisa·2022-03-07·CVSS 8.8
CVE-2022-26485 [HIGH] CWE-416 Mozilla Firefox Use-After-Free Vulnerability
Vulnerability: Mozilla Firefox Use-After-Free Vulnerability
Affected: Mozilla Firefox
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-26485
Remediation Due Date: 2022-03-21
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-03-06·CVSS 8.8
CVE-2022-26485 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
A use-after-free was discovered when removing an XSLT parameter in some
circumstances. If a user were tricked into opening a specially crafted
website, an attacker could exploit this to cause a denial of service, or
execute arbitrary code. (CVE-2022-26485)
A use-after-free was discovered in the WebGPU IPC framework. If a user
were tricked into opening a specially crafted website, an attacker could
exploit this to cause a denial of service, or execute arbitrary code.
(CVE-2022-26486)
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Red Hat
Mozilla: Use-after-free in XSLT parameter processing
vendor_redhat·2022-03-05·CVSS 8.8
CVE-2022-26485 [HIGH] CWE-416 Mozilla: Use-after-free in XSLT parameter processing
Mozilla: Use-after-free in XSLT parameter processing
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Package: firefox:flatpak/firefox (Red Hat Enterpr
Debian
CVE-2022-26485: firefox - Removing an XSLT parameter during processing could have lead to an exploitable u...
vendor_debian·2022·CVSS 8.8
CVE-2022-26485 [HIGH] CVE-2022-26485: firefox - Removing an XSLT parameter during processing could have lead to an exploitable u...
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Scope: local
sid: resolved (fixed in 99.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-09: CVE-2022-26485
vendor_mozilla·CVSS 8.8
CVE-2022-26485 [HIGH] Mozilla Foundation Security Advisory 2022-09: CVE-2022-26485
Mozilla Foundation Security Advisory 2022-09
CVE: CVE-2022-26485
Product: Firefox, Firefox ESR, Firefox for Android, Focus, Thunderbird
Impact: critical
Fixed in: Firefox 97.0.2
Firefox ESR 91.6.1
Firefox for Android 97.3
Focus 97.3
Thunderbird 91.6.2
GHSA
GHSA-rj77-m66j-h24w: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free
ghsa_unreviewed·2022-12-22
CVE-2022-26485 [HIGH] CWE-416 GHSA-rj77-m66j-h24w: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
OSV
CVE-2022-26485: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free
osv·2022-12-22·CVSS 8.8
CVE-2022-26485 [HIGH] CVE-2022-26485: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
OSV
firefox vulnerabilities
osv·2022-03-06·CVSS 8.8
CVE-2022-26485 [HIGH] firefox vulnerabilities
firefox vulnerabilities
A use-after-free was discovered when removing an XSLT parameter in some
circumstances. If a user were tricked into opening a specially crafted
website, an attacker could exploit this to cause a denial of service, or
execute arbitrary code. (CVE-2022-26485)
A use-after-free was discovered in the WebGPU IPC framework. If a user
were tricked into opening a specially crafted website, an attacker could
exploit this to cause a denial of service, or execute arbitrary code.
(CVE-2022-26486)
VulnCheck
Mozilla Firefox Use-After-Free Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-26485 [HIGH] CWE-416 Mozilla Firefox Use-After-Free Vulnerability
Mozilla Firefox Use-After-Free Vulnerability
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
Affected: Mozilla Firefox
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://blog.google/threat-analysis-group/new-details-on-commercial-spyware-vendor-variston/; https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf; https://www.mandiant.com/resources/blog/zero-days-exploited-2022; https://storage.googleapis.com/gweb-uniblog-pu
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1758062https://www.mozilla.org/security/advisories/mfsa2022-09/https://bugzilla.mozilla.org/show_bug.cgi?id=1758062https://www.mozilla.org/security/advisories/mfsa2022-09/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26485
2022-12-22
Published
2022-03-07
Added to CISA KEV
Exploited in the wild