What’s Vulnerable › Vulnerabilities

CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-10-15
• EPSS: 23.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-09 · updated 2026-08-04
• Weakness: CWE-416

Description

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Affected products

• Debian Linux: 11.0
• Mozilla Firefox: before 115.16.1; before 131.0.2; from 128.1.0 before 128.3.1 — fixed in 115.16.1, 128.3.1, 131.0.2
• Mozilla Thunderbird: before 115.16.0; from 128.0.1 before 128.3.1; 131.0 — fixed in 115.16.0, 128.3.1

How to fix

Upgrade to a fixed version: Mozilla Firefox 115.16.1, 128.3.1, 131.0.2; Mozilla Thunderbird 115.16.0, 128.3.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1923344
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039
• https://www.mozilla.org/security/advisories/mfsa2024-51/
• https://www.mozilla.org/security/advisories/mfsa2024-52/
• https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992
• https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html
• https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680

Get alerted when CVE-2024-9680 or the next vulnerability affects your stack