CVE-2021-29964: Mozilla Firefox

High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.

Affected products

• Mozilla Firefox: before 89.0 (fixed in 89.0)
• Mozilla Firefox ESR: before 78.11 (fixed in 78.11)
• Mozilla Thunderbird: before 78.11 (fixed in 78.11)

Published 2021-06-24. Last modified 2026-06-17.