CVE-2016-1974

CVE-2016-1974 describes a critical vulnerability in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before 38.7, affecting products from Mozilla, OpenSUSE, Oracle, and SUSE. The flaw, residing in the nsScannerString::AppendUnicodeTo function, stems from a failure to verify memory allocation success, allowing remote attackers to trigger an out-of-bounds read. This can lead to arbitrary code execution or a denial of service through crafted Unicode data in HTML, XML, or SVG documents. With a CVSS score of 8.8 (HIGH), this vulnerability presents a significant risk. It has a network attack vector, low attack complexity, and requires user interaction (UI:R), but can result in high impacts to confidentiality, integrity, and availability. The vulnerability is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Despite its high severity, there is no evidence of active exploitation (KEV: No) and no public exploit code available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article found, suggesting limited public attention at the time of discovery.