cve/2022/CVE-2022-26485.md

### [CVE-2022-26485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26485)
![](https://img.shields.io/static/v1?label=Product&message=Firefox%20ESR&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Firefox%20for%20Android&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Focus&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Thunderbird&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2091.6.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2091.6.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2097.0.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2097.3.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Use-after-free%20in%20XSLT%20parameter%20processing&color=brighgreen)

### Description

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/k0mi-tg/CVE-POC
- https://github.com/manas3c/CVE-POC
- https://github.com/mistymntncop/CVE-2022-26485
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/whoforget/CVE-POC
- https://github.com/youwizard/CVE-POC