CVE-2022-31747

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125CWE-416CWE-787CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-317489.8Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs prCVE-2022-317496.5An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allCVE-2022-31755.3Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-317515.5The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability.CVE-2022-317525.5Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality.CVE-2022-317537.5The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability mayCVE-2022-317547.5Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some fCVE-2022-317555.5The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect sCVE-2022-317565.5The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-317577.5The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentialitCVE-2022-317584.7The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-317595.5AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availabilit
CVE-2022-31747: Critical severity, CVSS 9.8 | Vulnix