Dashboard / CVE-2023-25738

CVE-2023-25738

MEDIUM
MEDIUM Priority: 0.04 BB Relevance: 63/100
Published: 2023-06-02 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Unchanged
C: None
I: None
A: High

Description

Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
mozilla firefox < 110.0
mozilla firefox_esr < 102.8
mozilla thunderbird < 102.8

References & Advisories (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=1811852
Issue Tracking Permissions Required

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.64%
Raw Score 0.006350
Percentile 50.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00635
2026-10-28
0.00635

Intelligence Sources

nvd ref →

External Links