Skip to content
CVE Tracker
Back

CVE-2017-7768

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by…

Medium5.5EPSS 0.32%
Published
Updated
Reserved
Assigned by
mozilla

Description

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Scores

CVSS scores of CVE-2017-7768, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.32% · top 75% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

Affected products

  • Mozilla · Firefox ESR

    • affected unspecified – < 52.2

  • Mozilla · Firefox

    • affected unspecified – < 54

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .