CVE-2023-6856

2023-12-1913:38:36

mozilla

www.cve.org

webgl

buffer overflow

vulnerability

firefox

thunderbird

remote code execution

sandbox escape

mesa vm driver

AI Score

8.9

Confidence

High

EPSS

0.005

Percentile

77.4%

JSON

The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CNA Affected

[
  {
    "product": "Firefox ESR",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "115.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Thunderbird",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "115.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "121",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]