Back
CVE-2017-7755
The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run.…
High7.8EPSS 1.4%
- Published
- Updated
- Reserved
- Assigned by
- mozilla
Description
The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.4% · top 28% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
- Privilege escalation through Firefox Installer with same directory DLL files
- CWE-426 (opens in a new tab)All about CWE-426 and its CVEs
Affected products
- affected unspecified – < 54
- affected unspecified – < 52.2
- affected unspecified – < 52.2
References (6)
- 99057 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.mozilla.org/security/advisories/mfsa2017-15/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- 1038689 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- https://bugzilla.mozilla.org/show_bug.cgi?id=1361326 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.mozilla.org/security/advisories/mfsa2017-17/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.mozilla.org/security/advisories/mfsa2017-16/ (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-7755)Record last updated .