CVE-2022-26485

Timeline

Detection, updates, and resolution for this record.

1. Mar 7, 2022 · Catalog

   Detected

   Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

2. Mar 7, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Mar 21, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 19, 2026 · Catalog

   Updated

   Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Affected

• cpe mozilla/firefoxversion unspecified
• cpe mozilla/firefox focusversion unspecified
• cpe mozilla/firefox mobileversion unspecified
• cpe mozilla/thunderbirdversion unspecified
• vendor Mozilla Firefoxversion unspecified

Sources

• CISA KEVCVE-2022-26485

  Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

  cisa.gov
• CVE.orgCVE-2022-26485

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2022-26485

  30-day exploitation probability 14.3%

  first.org
• NIST NVDCVE-2022-26485

  Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and

  nvd.nist.gov

References

• Exploit · bugzilla.mozilla.org
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · mozilla.org