Is CVE-2016-9893 being actively exploited?

CVE-2016-9893 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2016-9893?

CVE-2016-9893 has a CVSS 3.0 base score of 9.8 (CRITICAL).

CVE-2016-9893

CRITICAL · CVSS 9.8EPSS 2.5%EU EUVD

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Key facts

CVSS score: 9.8 (v3.0)
Severity: CRITICAL
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-119
EPSS score: 2.5% (85th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2016-10682)
Published: June 11, 2018
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-10682 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

debian / debian linux
mozilla / firefox
mozilla / thunderbird
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux workstation
redhat / enterprise linux workstation
redhat / enterprise linux workstation

Certified products that may be affected

7 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux libgcrypt Cryptographic Module v4.0 [1] and Red Hat Enterprise Linux libgcrypt Cryptographic Module v5.0 [2] - Red Hat®, Inc. - FIPS 140 2657 - historical
Red Hat Enterprise Linux 5 OpenSSH-Server Cryptographic Module - Red Hat®, Inc. - FIPS 140 1384 - historical
Red Hat Enterprise Linux 5 OpenSSH Client Cryptographic Module - Red Hat®, Inc. - FIPS 140 1385 - historical
Red Hat Enterprise Linux 5 OpenSwan Cryptographic Module - Red Hat®, Inc. - FIPS 140 1386 - historical
Red Hat Enterprise Linux 5 Kernel Crypto API Cryptographic Module - Red Hat®, Inc. - FIPS 140 1387 - historical

See all 7 in the Security Certifications Explorer.

References

http://rhn.redhat.com/errata/RHSA-2016-2946.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-2973.html(Third Party Advisory)
http://www.securityfocus.com/bid/94885(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1037461(Third Party Advisory, VDB Entry)
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1319524%2C1298773%2C1299098%2C1309834%2C1312609%2C1313212%2C1317805%2C1312548%2C1315631%2C1287912(Issue Tracking, Vendor Advisory)
https://security.gentoo.org/glsa/201701-15(Third Party Advisory)
https://www.debian.org/security/2017/dsa-3757(Third Party Advisory)
https://www.mozilla.org/security/advisories/mfsa2016-94/(Vendor Advisory)
https://www.mozilla.org/security/advisories/mfsa2016-95/(Vendor Advisory)
https://www.mozilla.org/security/advisories/mfsa2016-96/(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain