← CVE Radar
CVE-2024-9680Mozilla Firefox Use-After-Free Vulnerability
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
9.8 CRITICALEPSS 23.18%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Nov 5, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2024-9680
- Status
- Analyzed
- Assigner (CNA)
- mozilla
- Published
- Oct 9, 2024
- Last modified
- 2026-08-04 05:16 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
MozillaFirefox1 version range
- before 131.0.2
MozillaFirefox ESR1 version range
- before 128.3.1
MozillaFirefox ESR1 version range
- before 115.16.1
MozillaThunderbird1 version range
- before 131.0.1
MozillaThunderbird1 version range
- before 128.3.1
MozillaThunderbird1 version range
- before 115.16.0
References
- bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1923344
- msrc.microsoft.com https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039
- mozilla.org https://www.mozilla.org/security/advisories/mfsa2024-51/
- mozilla.org https://www.mozilla.org/security/advisories/mfsa2024-52/
- bugs.freebsd.org https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992
- lists.debian.org https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680