Is CVE-2019-11707 actively exploited?

Yes. CVE-2019-11707 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2019-11707 be exploited remotely?

The attack vector of CVE-2019-11707 has not been classified yet.

What is the CVSS score of CVE-2019-11707?

CVE-2019-11707 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2019-11707

HIGHCISA KEVIN THE WILD

CVE-2019-11707

Published: May 23, 2022

EPSS:83.30%probability of exploitation in 30 daysPercentile:99.2th

Official Description

Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

NVD Source

CISA KEV Advisory

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

Added to KEV: 2022-05-23Federal patch deadline: 2022-06-13

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

Mozilla Firefox and Thunderbird contain a type confusion vulnerability in JavaScript object manipulation, specifically affecting Array.pop, which can lead to an exploitable crash. With an EPSS score of 0.83304 and inclusion in CISA's KEV, this flaw presents a high risk of exploitation.

This vulnerability is actively being exploited in the wild, confirming its use by attackers. Exploitation is typically remote and can occur when a user visits a malicious website or opens a crafted email.

Recommended Action

Users of Mozilla Firefox and Thunderbird should update their applications to the latest available versions to patch this vulnerability. Exercise caution when browsing untrusted websites or opening suspicious emails.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2019-11707 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2019-11707 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.