CVE-2022-40962

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.

• CWE-787
• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1776655%2C1777574%2C1784835%2C1785109%2C1786502%2C1789440Broken Link, Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2022-40/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-41/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-42/Vendor Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1776655%2C1777574%2C1784835%2C1785109%2C1786502%2C1789440Broken Link, Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2022-40/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-41/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-42/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40957Inconsistent data in instruction and data cache when creatin…6.5
• CVE-2022-40958By injecting a cookie with certain special characters, an at…6.5
• CVE-2022-40959During iframe navigation, certain pages did not have their F…6.5
• CVE-2022-4096Server-Side Request Forgery (SSRF) in GitHub repository apps…6.5
• CVE-2022-40960Concurrent use of the URL parser with non-UTF-8 data was not…6.5
• CVE-2022-40961During startup, a graphics driver with an unexpected name co…6.5
• CVE-2022-40963Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) v…5.4
• CVE-2022-40964Improper access control for some Intel(R) PROSet/Wireless Wi…6.7
• CVE-2022-40965The affected product DIAEnergie (versions prior to v1.9.01.0…5.4
• CVE-2022-40966Authentication bypass vulnerability in multiple Buffalo netw…8.8
• CVE-2022-40967The affected product DIAEnergie (versions prior to v1.9.01.0…8.8
• CVE-2022-40968Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Am…6.1