CVE-2021-43539

—

CVSS 3.1

8.8 high

EPSS

2%p75

Published

Dec 8, 2021 (Dec 8, 2021)

Modified

Jun 17, 2026

Description

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

Vendors: mozilla debian
Products: firefox, firefox esr, thunderbird, debian linux
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news1 stories

Mozilla fixed high-severity bugs in Firefox and Thunderbird mail client

Security AffairsDec 9, 19:17 UTC · Dec 9, 2021Vulnerability CVE-2021-43536 CVE-2021-43538 CVE-2021-43539