CVE-2009-2478

CVE-2009-2478 describes a denial-of-service vulnerability in Mozilla Firefox 3.5, where remote attackers can trigger a NULL pointer dereference and application crash through unspecified vectors, linked to a "flash bug." This vulnerability has a CVSS score of 5.0, indicating a medium severity, and can be exploited remotely with low attack complexity, leading to a partial impact on availability. While not listed on the KEV catalog or Hot List, and with no Metasploit or Nuclei modules, there are two ExploitDB entries (EDB-9181 and EDB-9137) referencing remote heap spray and buffer overflow techniques related to "Font tags." Despite these public exploit examples, there is no evidence of active exploitation, and the CVE has received minimal community discussion or media coverage.