CVE-2021-38493

8.8 HIGH

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13

Published: 2021-11-03 · Last updated: 2026-06-17

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-787

Affected products

Vendor	Product
mozilla	firefox, firefox_esr, thunderbird

Description

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14, and Firefox < 92.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38493
[Vendor advisory]https://bugzilla.mozilla.org/buglist.cgi?bug_id=1723391%2C1724101%2C1724107
[Other]https://security.gentoo.org/glsa/202202-03
[Other]https://security.gentoo.org/glsa/202208-14
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-38/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-39/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-42/
[Vendor advisory]https://bugzilla.mozilla.org/buglist.cgi?bug_id=1723391%2C1724101%2C1724107
[Other]https://security.gentoo.org/glsa/202202-03
[Other]https://security.gentoo.org/glsa/202208-14
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-38/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-39/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-42/

Related CVEs

Same vendor

CVE-2026-12330 — Incorrect boundary conditions in the Internationalization component (5.4 MEDIUM)
CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
CVE-2026-12328 — Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (8.1 HIGH)
CVE-2026-12323 — Spoofing issue in the DOM: Core & HTML component (5.4 MEDIUM)
CVE-2026-12322 — Clickjacking issue in the Widget: Gtk component (5.4 MEDIUM)

Same CWE

CVE-2026-47750 — stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inf... (7.8 HIGH)
CVE-2026-47747 — stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inf... (7.8 HIGH)
CVE-2026-47749 — stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inf... (7.8 HIGH)
CVE-2026-12314 — Memory safety bug fixed in Thunderbird 152 (7.5 HIGH)
CVE-2026-12310 — Memory safety bug fixed in Thunderbird 152 (7.5 HIGH)