CVE-2024-4367
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context
Medium · published May 14, 2024
Patch now
High probability of exploitation
CVSS calls it medium at 5.6. It sits in the 99.4th percentile for exploit probability.
What it is
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
The record
Technical detail
- CVSS v3.1
- 5.6 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.70660 · 99.4th percentile
- Published
- 2024-05-14T17:21Z
EPSS history
Timeline