AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2009-3376

HIGH · CVSS 9.3 EPSS 3.18%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2009-10-29 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2009-3376
Severity
HIGH
CVSS
9.3
EPSS
3.18%
Firefox

Original Filing — NVD Description

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.