CVE-2016-1964

CVE-2016-1964 is a critical use-after-free vulnerability in the AtomicBaseIncDec function of Mozilla Firefox versions prior to 45.0 and Firefox ESR 38.x before 38.7. This flaw, stemming from mishandling of XML transformations, allows remote attackers to execute arbitrary code or trigger a denial of service via heap memory corruption. With a CVSS score of 8.8 (High), it presents a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability garnered some community discussion and media coverage at the time of its disclosure, indicating awareness within the security community.