CVE-2021-29964
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process...
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
- Record
CVE-2021-29964- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
- Record
CVE-2021-29964- Updated
- 2026-11-02
EUVDEUVD-2021-16423 No score
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
- Record
EUVD-2021-16423- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mgf-v5gc-vgc7 No score
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process...
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
- Record
GHSA-6mgf-v5gc-vgc7- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-29964
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
- Record
ALPINE-CVE-2021-29964- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2021-29964
A locally-installed hostile program could send WM_COPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
- Record
UBUNTU-CVE-2021-29964- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVMGASA-2021-0242 No score
Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
Out of bounds-read when parsing a WM_COPYDATA message. (CVE-2021-29964)
Memory safety bugs fixed in Thunderbird 78.11. (CVE-2021-29967)
- Record
MGASA-2021-0242- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0858-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0858-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0910-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.11 (bsc#1186696)
Security issues fixed:
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11
General improvements:
- OpenPGP could not be disabled for an account if a key was previously configured
- Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME
- Contacts moved between CardDAV address books were not synced to the new server
- CardDAV compatibility fixes for Google Contacts
- Folder pane had no clear indication of focus on macOS
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0910-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1884-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
openSUSE-SU-2021:1884-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2003-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.11 (bsc#1186696)
Security issues fixed:
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11
General improvements:
- OpenPGP could not be disabled for an account if a key was previously configured
- Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME
- Contacts moved between CardDAV address books were not synced to the new server
- CardDAV compatibility fixes for Google Contacts
- Folder pane had no clear indication of focus on macOS
- Record
openSUSE-SU-2021:2003-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score
MozillaFirefox-92.0-1.2 on GA media
These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10600-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score
MozillaThunderbird-91.1.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10601-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:14743-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:14743-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1884-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:1884-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1886-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:1886-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1919-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:1919-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2003-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 78.11 (bsc#1186696)
Security issues fixed:
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11
General improvements:
- OpenPGP could not be disabled for an account if a key was previously configured
- Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME
- Contacts moved between CardDAV address books were not synced to the new server
- CardDAV compatibility fixes for Google Contacts
- Folder pane had no clear indication of focus on macOS
- Record
SUSE-SU-2021:2003-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdAlpine:v3.16 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.17 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.18 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.19 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.20 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.21 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.22 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.23 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdMageia:7 From an advisory covering 2 CVEs |
before 78.11.0-1.mga7 | 78.11.0-1.mga7 |
thunderbird-l10nMageia:7 From an advisory covering 2 CVEs |
before 78.11.0-1.mga7 | 78.11.0-1.mga7 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
thunderbirdMageia:8 From an advisory covering 2 CVEs |
before 78.11.0-1.mga8 | 78.11.0-1.mga8 |
thunderbird-l10nMageia:8 From an advisory covering 2 CVEs |
before 78.11.0-1.mga8 | 78.11.0-1.mga8 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 3 CVEs |
before 78.11.0-78.131.1 | 78.11.0-78.131.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 From an advisory covering 3 CVEs |
before 78.11.0-8.43.1 | 78.11.0-8.43.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 3 CVEs |
before 78.11.0-8.43.1 | 78.11.0-8.43.1 |
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud 9 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Manager Proxy 4.0 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Manager Retail Branch Server 4.0 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Manager Server 4.0 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Enterprise Storage 6 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP2 From an advisory covering 2 CVEs |
before 78.11.0-8.30.1 | 78.11.0-8.30.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP3 From an advisory covering 2 CVEs |
before 78.11.0-8.30.1 | 78.11.0-8.30.1 |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
MozillaFirefoxopenSUSE:Leap 15.2 From an advisory covering 3 CVEs |
before 78.11.0-lp152.2.58.1 | 78.11.0-lp152.2.58.1 |
MozillaThunderbirdopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 78.11.0-lp152.2.45.1 | 78.11.0-lp152.2.45.1 |
MozillaFirefoxopenSUSE:Leap 15.3 From an advisory covering 3 CVEs |
before 78.11.0-8.43.1 | 78.11.0-8.43.1 |
MozillaThunderbirdopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 78.11.0-8.30.1 | 78.11.0-8.30.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 661 CVEs |
before 92.0-1.2 | 92.0-1.2 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 394 CVEs |
before 91.1.1-1.1 | 91.1.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29964 is a high vulnerability (CVSS 7.1) in Mozilla Firefox, published June 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in thunderbird 91.3.2-r0.
References
mozilla.org/security/advisories/mfsa2021-26
bugzilla.mozilla.org/show_bug.cgi?id=1706501
nvd.nist.gov/vuln/detail/CVE-2021-29964
github.com/advisories/GHSA-6mgf-v5gc-vgc7
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2021-29964
advisories.mageia.org/MGASA-2021-0242.html
bugs.mageia.org/show_bug.cgi?id=29073
thunderbird.net/en-US/thunderbird/78.11.0/releasenotes
suse.com/support/update/announcement/2021/suse-su-202114743-1
bugzilla.suse.com/1185633
ubuntu.com/security/CVE-2021-29964
cve.org/CVERecord?id=CVE-2021-29964
lists.opensuse.org/archives/list/[email protected]/thread/E2JRSLMFXKIDH3M3V6MCQ6BEUR3XMG5L
Left out here: 1,776 references. The JSON record has them.