CVE-2021-29955

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-24 · updated 2026-06-17
Weakness: CWE-74

Description

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.

Affected products

Mozilla Firefox: before 87.0 — fixed in 87.0
Mozilla Firefox ESR: before 78.9 — fixed in 78.9

How to fix

Upgrade to a fixed version: Mozilla Firefox 87.0; Mozilla Firefox ESR 78.9. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1692972
https://www.mozilla.org/security/advisories/mfsa2021-10/
https://www.mozilla.org/security/advisories/mfsa2021-11/
https://bugzilla.mozilla.org/show_bug.cgi?id=1692972
https://www.mozilla.org/security/advisories/mfsa2021-10/
https://www.mozilla.org/security/advisories/mfsa2021-11/

Get alerted when CVE-2021-29955 or the next vulnerability affects your stack