CVE-2023-25737

HIGH 8.8CVE-2023-25737 · Published 02/06/2023 · updated 24/10/2026

In short

CVE-2023-25737 is a HIGH (CVSS 8.8) vulnerability affecting firefox (mozilla), firefox esr (mozilla), thunderbird (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.3% of all vulnerabilities.
Fix: update to 110.0, 102.8 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 110.0`	`110.0`
firefox esr mozilla	`< 102.8`	`102.8`
thunderbird mozilla	`< 102.8`	`102.8`

Description

An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

References

bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
mozilla.org/security/advisories/mfsa2023-05 · Vendor Advisory
mozilla.org/security/advisories/mfsa2023-06 · Vendor Advisory
mozilla.org/security/advisories/mfsa2023-07 · Vendor Advisory

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firefox

mozilla

< 110.0

110.0

firefox esr

mozilla

< 102.8

102.8

thunderbird

mozilla

< 102.8

102.8

More vulnerabilities in firefox

See all →