CVE-2023-6856

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver

published December 19, 2023

CVSS
—
EPSS
21%
Percentile
97.5
In the wild
Unconfirmed
What it is

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.20630 · 97.5th percentile
Published
2023-12-19T13:38Z
EPSS history
Timeline
  • 19 DEC 13:38Z
    The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver
    cvelistv5