CVE-2016-9079

7.5

CVSS
High

PUBLISHED

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild...

Exploited in the wild Remote Low complexity No user interaction

Vendor: Mozilla
Product: Firefox, Firefox ESR, Thunderbird
Published: Jun 11, 2018
EPSS: —

Description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

windows cisa metasploit

CVSS scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 5.0

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitation status

Exploited in the wild

Recorded 2023-06-22 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: partial

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Jun 22, 2023

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/firefox_smil_uaf.rb	Apr 28, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

firefox_smil_uaf

metasploit · Created Unknown

Metasploit module for CVE-2016-9079

Tau-hub/Firefox-CVE-2016-9079

github · Created 2021-10-08 21:44:13 UTC · 1 stars

dangokyo/CVE-2016-9079

github · Created 2018-07-29 12:55:27 UTC · 7 stars

A demo exploit of CVE-2016-9079 on Ubuntu x64

LakshmiDesai/CVE-2016-9079

github · Created 2017-02-08 07:41:37 UTC · 1 stars

CVE-2016-9079 exploit code as it appeared on https://lists.torproject.org/pipermail/tor-talk/2016-November/042639.html

Vulnerability detail