What is CVE-2019-11753?

CVE-2019-11753 is a high-severity vulnerability in Microsoft Windows, classified under Improper Validation of Integrity Check Value. CVSS score: 7.8/10. Published 2019-09-27.

How severe is CVE-2019-11753?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Microsoft Windows

CVE-2019-11753

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Published 2019-09-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (12.2th percentile), scored 2026-10-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Microsoft Windows
Mozilla Firefox — versions unspecified
Mozilla Firefox Esr — versions unspecified, unspecified
Mozilla Firefox Esr

Weakness classification (CWE)

CWE-354 — Improper Validation of Integrity Check Value

References

bugzilla.mozilla.org/show_bug.cgi (Permissions Required, Issue Tracking, Vendor Advisory)
www.mozilla.org/security/advisories/mfsa2019-25/ (Vendor Advisory)
www.mozilla.org/security/advisories/mfsa2019-27/ (Vendor Advisory)
www.mozilla.org/security/advisories/mfsa2019-26/ (Vendor Advisory)
lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html (vendor-advisory)
lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html (vendor-advisory)

Frequently asked questions

What is CVE-2019-11753?: CVE-2019-11753 is a high-severity vulnerability in Microsoft Windows, classified under Improper Validation of Integrity Check Value. CVSS score: 7.8/10. Published 2019-09-27.
How severe is CVE-2019-11753?: High severity. CVSS v3 base score is 7.8 out of 10.