CVE-2022-22756

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

Affected

Mozilla · Firefox · Thunderbird · Firefox ESR

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.93% chance of exploitation in the next 30 days, 60th percentile

Published

2022-12-22

Updated

2025-04-16

Proof-of-concept exploits (1)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1317873

Security advisories

• https://www.mozilla.org/security/advisories/mfsa2022-04
• https://www.mozilla.org/security/advisories/mfsa2022-05
• https://www.mozilla.org/security/advisories/mfsa2022-06

References

• CVE Record
• NVD entry