CVE-2021-38500

8.8 HIGH

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1

Published: 2021-11-03 · Last updated: 2026-06-17

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Vendor	Product
debian	debian_linux, firefox, firefox_esr
mozilla	debian_linux, firefox, firefox_esr

Description

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38500
[Other]https://bugzilla.mozilla.org/buglist.cgi?bug_id=1725854%2C1728321
[Other]https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
[Other]https://www.debian.org/security/2022/dsa-5034
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-43/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-44/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-45/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-46/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-47/
[Other]https://bugzilla.mozilla.org/buglist.cgi?bug_id=1725854%2C1728321
[Other]https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
[Other]https://www.debian.org/security/2022/dsa-5034
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-43/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-44/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-45/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-46/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-47/

Related CVEs

Same vendor

CVE-2026-12330 — Incorrect boundary conditions in the Internationalization component (5.4 MEDIUM)
CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
CVE-2026-12328 — Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (8.1 HIGH)
CVE-2026-12323 — Spoofing issue in the DOM: Core & HTML component (5.4 MEDIUM)
CVE-2026-12322 — Clickjacking issue in the Widget: Gtk component (5.4 MEDIUM)