CVE-2011-2371: Mozilla Firefox Array.reduceRight integer overflow enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with a maximum CVSS 2.0 score and very high EPSS, though the software is long end-of-life and no KEV listing or confirmed exploit reference is present.

What it is

An integer overflow in the JavaScript Array.reduceRight method affects Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14. A long JavaScript Array object triggers the overflow, which can lead to arbitrary code execution. The flaw matters because it is remotely reachable through normal browsing or mail rendering with no credentials required.

Impact

An attacker can execute arbitrary code in the context of the affected application, giving full control of confidentiality, integrity and availability on the victim host. The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C reflects complete compromise.

Attack surface

Reached over the network by delivering crafted JavaScript that builds a long Array and calls reduceRight, typically via a malicious web page or HTML mail. No authentication is needed; user interaction is implied by loading the page or message, though the record does not state it explicitly.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.75691 (99.5th percentile), indicating a high modeled likelihood of exploitation activity. The record does not confirm public exploit code.

What to do

• Upgrade Firefox to 3.6.18 or later, or 4.0.1 or later, and apply the corresponding Thunderbird and SeaMonkey updates.
• Apply vendor and distribution patches (Mozilla MFSA 2011-22, Red Hat RHSA-2011-0885/0887/0888, Debian DSA-2268/2269/2273, Ubuntu USN-1149-1, openSUSE, Mandriva) where the browser cannot be upgraded directly.
• Disable or restrict JavaScript in mail clients and untrusted browsing contexts where feasible.
• Retire or isolate end-of-life Firefox 3.x/4.x, Thunderbird 3.x and SeaMonkey 2.x builds that cannot be patched.

Detection

• Monitor for crashes or abnormal process termination in Firefox, Thunderbird or SeaMonkey tied to JavaScript Array operations.
• Hunt for exploit-like JavaScript containing very large Array construction followed by reduceRight in web or mail content inspection logs.
• Check endpoint and vulnerability scan inventories for Firefox < 3.6.18 or 4.x <= 4.0.1, Thunderbird < 3.1.11 and SeaMonkey <= 2.0.14.
• Review proxy or IDS alerts for known exploit delivery against these browser versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.