CVE-2024-9680KEV · OVERDUECWE-416

Mozilla Firefox Use-After-Free Vulnerability

Critical · published October 9, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.8th percentile for exploit probability.

717
days past CISA
deadline
CVSS v3.1
9.8
EPSS
23%
Percentile
97.8
In the wild
Confirmed
What it is

🚨 A sneaky use-after-free in Firefox and Thunderbird is letting attackers execute code like a magician pulling rabbits from a hat — and it’s already being exploited in the wild! 🔥 Think of it like a restaurant where a waiter forgets to clear a table. While they’re setting it up for new diners, the previous customers can still sneak in and grab leftovers from the table—they shouldn’t be there, but the door’s wide open! If exploited, attackers could gain total control over your browser or email client, opening the door to data theft, malware deployment, or even complete system takeover. This is absolutely devastating and could lead to widespread compromise if not addressed swiftly!

Put simply

Think of it like a restaurant where a waiter forgets to clear a table. While they’re setting it up for new diners, the previous customers can still sneak in and grab leftovers from the table—they shouldn’t be there, but the door’s wide open! This vulnerability arises from a use-after-free error in animation timelines, allowing malicious actors to execute arbitrary code in the affected content processes of Firefox and Thunderbird.

What to do

If exploited, attackers could gain total control over your browser or email client, opening the door to data theft, malware deployment, or even complete system takeover. This is absolutely devastating and could lead to widespread compromise if not addressed swiftly! Update Firefox to version 131.0.2 or later, and Thunderbird to version 131.0.1 or later. For those using Extended Support Releases (ESR), ensure you’re on Firefox ESR 128.3.1 or later and Thunderbird ESR 128.3.1 or later. Don’t delay—patch ASAP! You’ve got this! Follow these steps, and you’ll lock down your systems in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.23184 · 97.8th percentile
Weakness
CWE-416 · Use After Free
Published
2024-10-09T17:15Z
KEV added
2024-10-15 · due 2024-11-05
Affected products (7)
ProductVersionsFixed in
mozilla/firefox< 115.16.1115.16.1
mozilla/firefox< 131.0.2131.0.2
mozilla/firefox≥ 128.1.0, < 128.3.1128.3.1
mozilla/thunderbird< 115.16.0115.16.0
mozilla/thunderbird≥ 128.0.1, < 128.3.1128.3.1
mozilla/thunderbirdall versions—
debian/debian_linuxall versions—
References (8)
EPSS history
Timeline
  • 15 OCT 00:00Z
    Added to CISA KEV — remediate by Nov 5
    kev
  • 09 OCT 12:59Z
    An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines
    cvelistv5