CVE-2022-28289highCWE-787

CVE-2022-28289: high-severity vulnerability in Mozilla Thunderbird

Published 22 Dec 2022 · Updated 16 Apr 2025

Follow this CVE + Monitor Firefox + Monitor Thunderbird

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.7%

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Mozilla · Firefox Mozilla · Firefox ESR Mozilla · Thunderbird

Related CVEs — Mozilla Thunderbird

In the same product, most dangerous first.

CVE-2016-9079HIGHCVE-2016-9079EPSS 87.4%KEV CVE-2019-11708CRITICALCVE-2019-11708EPSS 55.9%KEV CVE-2019-17026HIGHCVE-2019-17026EPSS 46.3%KEV CVE-2019-11707HIGHCVE-2019-11707EPSS 38.0%KEV CVE-2024-9680CRITICALCVE-2024-9680EPSS 23.2%KEV CVE-2022-26485HIGHCVE-2022-26485EPSS 14.3%KEV

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663508%2C1744525%2C1753508%2C1757476%2C1757805%2C1758549%2C1758776 https://www.mozilla.org/security/advisories/mfsa2022-13/https://www.mozilla.org/security/advisories/mfsa2022-14/https://www.mozilla.org/security/advisories/mfsa2022-15/