CVE-2024-11693

The executable file warning was not presented when downloading .library-ms files

Critical · published November 26, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

🚨 A sneaky spot for executable files! When downloading .library-ms files in Firefox and Thunderbird on Windows, users may not see the warning they absolutely should! 🔥 Think of it like a restaurant serving a dish that could contain allergens without any notice — it’s all fun and games until someone has a serious reaction! Ignoring those warnings can lead to consequences no one wants to face. This vulnerability could allow malicious files to be downloaded without any safety prompts, potentially leading users to execute dangerous code unwittingly. Imagine clicking on a seemingly harmless file only to unleash chaos on your system! Protecting users is critical here!

Put simply

Think of it like a restaurant serving a dish that could contain allergens without any notice — it’s all fun and games until someone has a serious reaction! Ignoring those warnings can lead to consequences no one wants to face. When users download .library-ms files, the executable file warning is missing in versions of Firefox and Thunderbird prior to 133 and 128.5 respectively, creating an opening for malicious file execution without any alert.

What to do

This vulnerability could allow malicious files to be downloaded without any safety prompts, potentially leading users to execute dangerous code unwittingly. Imagine clicking on a seemingly harmless file only to unleash chaos on your system! Protecting users is critical here! Update Firefox to version 133 or later and Thunderbird to version 133 or later as well to ensure users see those crucial warnings when downloading files. Don't forget to check for any additional patches that may enhance security. 🛡️ You've got this! By patching up now, you’re making the web a safer place for everyone! 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00827 · 57.0th percentile
Published
2024-11-26T13:33Z
EPSS history
Timeline
  • 26 NOV 13:33Z
    The executable file warning was not presented when downloading .library-ms files
    cvelistv5