This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke…

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2016-6246

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.

Patch / fix

fixed in 1 distros 1

Mozilla Firefox 50

firefox-esr openSUSE Tumbleweed 128.5.1-1.1
MozillaFirefox openSUSE Tumbleweed 50.1.0-1.1

opensuse advisories openSUSE-SU-2024:14572-1 openSUSE-SU-2024:10071-1

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

Mozilla Firefox

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

mozilla.org /en-US/security/advisories/mfsa2013-44/
vendor-advisory
mozilla.org /security/advisories/mfsa2016-89/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=1247239
issue-tracking, vendor-advisory
securityfocus.com /bid/94337
vdb-entry, third-party-advisory
securitytracker.com /id/1037298
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-5295
NVD CVE-2016-5295

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary