CVE-2016-9079Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

7.5 HIGHEPSS 87.35%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 00:55 UTC

OverviewCVSS details

7.5HIGHCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Jun 11, 2018
Assigner: mozilla

Affected

Firefox (Mozilla)

Versions: before 50.0.2
Fixed in: 50.0.2

+2 more products →

Exploitation

Public exploit: Yes · 3 references
CISA KEV: Listed · Jun 22, 2023
KEV due date: Jul 13, 2023
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 8

87.35%chance of exploitation in 30 days

Higher than 99.75% of CVEs

CVSS 3.1 · NVD

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

CVSS 2.0 · NVD

5.0Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack vector: Network
Attack complexity: Low
Authentication: None
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.5	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5.0	MEDIUM	2.0NVD	AV:N/AC:L/Au:N/C:P/I:N/A:N

CISA required action

⚡ Known exploited · remediation due Jul 13, 2023

Apply updates per vendor instructions.

Details

CVE ID: CVE-2016-9079
Status: Analyzed
Assigner (CNA): mozilla
Published: Jun 11, 2018
Last modified: 2026-06-17 00:55 UTC
Weaknesses: CWE-416

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 14:43 UTC.