Dashboard / CVE-2023-25752

CVE-2023-25752

MEDIUM
MEDIUM Priority: 0.04 BB Relevance: 63/100
Published: 2023-06-02 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Unchanged
C: None
I: High
A: None

Description

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Affected Software (3)

VendorProductVersion
mozilla firefox < 111.0
mozilla firefox_esr < 102.9
mozilla thunderbird < 102.9

References & Advisories (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=1811627
Issue Tracking Permissions Required Vendor Advisory

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.61%
Raw Score 0.006100
Percentile 49.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00610
2026-10-28
0.00610

Intelligence Sources

nvd ref →

External Links