Search for vulnerabilities
Vulnerability details: VCID-vf4x-44t6-13dz
Vulnerability ID VCID-vf4x-44t6-13dz
Aliases CVE-2016-1961
Summary Security researcher lokihardt, working with HP's Zero Day Initiative, reported a use-after-free issue in the SetBody function of HTMLDocument. This results in a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
epss 0.01253 https://api.first.org/data/v1/epss?cve=CVE-2016-1961
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2016-24
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-1961.json
https://api.first.org/data/v1/epss?cve=CVE-2016-1961
1315577 https://bugzilla.redhat.com/show_bug.cgi?id=1315577
CVE-2016-1961 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1961
mfsa2016-24 https://www.mozilla.org/en-US/security/advisories/mfsa2016-24
RHSA-2016:0373 https://access.redhat.com/errata/RHSA-2016:0373
RHSA-2016:0460 https://access.redhat.com/errata/RHSA-2016:0460
USN-2917-1 https://usn.ubuntu.com/2917-1/
USN-2934-1 https://usn.ubuntu.com/2934-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.78502
EPSS Score 0.01253
Published At Aug. 9, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:14.859156+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2016/mfsa2016-24.md 37.0.0