Yes. CISA added CVE-2016-9079 to its Known Exploited Vulnerabilities catalogue on 22 June 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
What “being exploited in the wild” means for this CVE
CISA listing a CVE in the Known Exploited Vulnerabilities catalogue is a strong operational signal, because the catalogue is reserved for vulnerabilities with reliable evidence of active exploitation. For defenders, that changes the question from “should we track this?” to “where could this weakness still be reachable, and what exposure does it create if it is?”
The practical issue is not just that the flaw exists, but that a real exploitation path has already been observed. That means inventory accuracy, exposure scope, and response speed matter more than theoretical severity. If the vulnerable software is present on internet-facing systems, email clients, or endpoints that handle untrusted content, the time window for safe deferral is usually very small.
For current status and remediation detail, use CISA Known Exploited Vulnerabilities Catalog together with the vendor advisory and the record in NIST National Vulnerability Database. That pairing helps you confirm whether the product appears in your environment and whether your remediation plan matches the exact exposure class.
Why this matters for Firefox, Firefox ESR, and Thunderbird
This CVE is a use-after-free issue in SVG Animation, so the risk is tied to unsafe memory handling during content processing. In practice, that kind of flaw can be attractive because it may be triggered through normal user workflows, such as opening content or visiting a page, rather than through unusual administrative actions.
The named products matter because browser and mail-client exposure is often broad and hard to spot if asset inventories only focus on servers. Firefox, Firefox ESR, and Thunderbird can be deployed widely across endpoints, and browser-targeted exploitation can become a foothold for credential theft, session abuse, or follow-on payload delivery if the attacker gains code execution.
When you are triaging exposure, it helps to separate installed software from actually exposed attack surface. A managed desktop with rapid update enforcement is very different from unmanaged endpoints, remote workers, or systems that still allow delayed patching and untrusted browsing patterns. The response priority should follow the latter, not the former.
For browser-facing risk reduction, NHIMG’s Enterprise Browser and Browser Security Guide is useful context for hardening, isolation, and extension control, which are often the controls that reduce impact when a browser-family flaw is being actively exploited.
What to do if patching is delayed
If remediation must wait, treat the system as exposed rather than merely vulnerable. The immediate question is whether the affected product is reachable by hostile content, whether users can render untrusted SVG or HTML content, and whether the endpoint has compensating controls that materially reduce exploitability.
Priority actions are containment and verification, not just scheduling a later patch. Reduce exposure by limiting untrusted browsing, tightening attachment handling, and isolating higher-risk users or systems. If you cannot remove the product quickly, shrink the number of systems that can be used as an initial execution point, then confirm whether security tooling can detect the kind of abnormal process or memory activity that often follows exploitation.
CVE Program records, vendor advisories, and FIRST EPSS are useful for prioritisation, but they should not override the KEV signal when active exploitation is already confirmed. A KEV-listed issue should move into emergency handling, not routine backlog management.
Risk and Threat Considerations
Because this CVE is already in KEV, the risk is not hypothetical exploitation, but ongoing attacker interest in a reachable code path. Browser and mail-client flaws are especially dangerous when users routinely process untrusted web or message content, because that gives attackers a realistic entry point without needing privileged access first.
Failure mechanism: A use-after-free condition can let attacker-controlled input influence freed memory, which may lead to crash, code execution, or another exploitable memory-safety outcome depending on context and exploit reliability.
Impact: If exploitation succeeds, the attacker may gain initial execution on the endpoint, enabling account compromise, session theft, malware delivery, or pivoting to broader internal access from a trusted user device.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes exposure tracking and rapid remediation central. |
| Recommendation — Prioritise internet-facing and high-risk endpoints for immediate remediation and validation. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The CVE requires prompt remediation of a known exploited software flaw. |
| RA-5 — Vulnerability Monitoring and Scanning | You need reliable discovery of where the affected products are deployed. | |
| Recommendation — Accelerate patching and document exceptions with compensating controls. Scan for affected installations and confirm remediation status continuously. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Use-after-free is a memory-safety weakness relevant to secure software design. |
| Recommendation — Review memory-safety defects and validate that exploit paths are removed. | ||
Practitioner Guidance
What to verify: Confirm whether Firefox, Firefox ESR, or Thunderbird is installed on any internet-facing, high-risk, or slow-to-patch endpoint class. Then verify whether those systems can render untrusted content and whether compensating controls, such as browser isolation or restricted content handling, are actually enforced.
Decision rule: If the software is present and cannot be updated immediately, treat the system as a higher-risk exception until you have containment, monitoring, and a dated remediation commitment. If user impact is acceptable, emergency patching should take precedence over normal maintenance windows.
Practitioner takeaway: KEV inclusion should be read as an exploitation alert, not just a patching notice, so the right response is to find exposure quickly, constrain the attack surface, and assume the issue may already have been targeted.