CVE-2014-1578: Mozilla Firefox

High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days.

The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.

Affected products

• Mozilla Firefox: version 31.0 only; version 31.1.0 only; up to and including 32.0; version 30.0 only
• Mozilla Thunderbird: version 31.0 only; version 31.1.0 only

Published 2014-10-15. Last modified 2026-06-17.