CVE-2016-5276

Critical

Published: 22/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4. It allows remote attackers to execute arbitrary code or cause a denial of service via an aria-owns attribute.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the security of systems and user data. This could lead to loss of control over the system or its destabilization.

Recommendation

It is recommended to update Mozilla Firefox and Thunderbird to the latest versions to mitigate this vulnerability. Regular software updates are crucial for maintaining security.

Original NVD description (English source)

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute.