CVE-2024-9680
Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird
Published 9 Oct 2024 · updated 4 Aug 2026 · Analyzed
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 15 Oct 2024, with a remediation deadline of 5 Nov 2024 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
References
- bugzilla.mozilla.org/show_bug.cgi?id=1923344 · Issue Tracking, Permissions Required
- msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039 · Not Applicable, Patch, Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2024-51/ · Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2024-52/ · Vendor Advisory
- bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992 · Issue Tracking
- lists.debian.org/debian-lts-announce/2024/10/msg00005.html · Mailing List
- lists.debian.org/debian-lts-announce/2024/10/msg00006.html · Mailing List
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680 · US Government Resource