CVE-2009-2479: Mozilla Firefox

High severity, CVSS 7.8. EPSS: 12.1% chance of exploitation in the next 30 days.

Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application crash) via a long Unicode string argument to the write method. NOTE: this was originally reported as a stack-based buffer overflow. NOTE: on Linux and Mac OS X, a crash resulting from this long string reportedly occurs in an operating-system library, not in Firefox.

Affected products

• Mozilla Firefox: version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 3.0.4 only; version 3.0.5 only; version 3.0.6 only; …

Published 2009-07-16. Last modified 2026-06-16.