CVE-2021-43537

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-704

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 91.4.0
Mozilla	Firefox ESR	>= unspecified, < 91.4.0
Mozilla	Firefox	>= unspecified, < 95

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1738237Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://security.gentoo.org/glsa/202208-14Third Party Advisory
https://www.debian.org/security/2021/dsa-5026Mailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5034Mailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-52/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-53/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-54/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1738237Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://security.gentoo.org/glsa/202208-14Third Party Advisory
https://www.debian.org/security/2021/dsa-5026Mailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5034Mailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-52/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-53/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-54/Vendor Advisory

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-435384.3By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full scre CVE-2021-435398.8Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing CVE-2021-43548.8The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_CVE-2021-435406.5WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been CVE-2021-435416.5When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerabil CVE-2021-435426.5Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. Thi CVE-2021-435436.1Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vu CVE-2021-435446.1When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have ca CVE-2021-435456.5Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Fi CVE-2021-435464.3It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbi CVE-2021-435478.2TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to f CVE-2021-435486.5Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that th