ZeroDay Findings
Sign inSign up

Findings

CVE-2024-9680

Mozilla Firefox Use-After-Free Vulnerability

Published Oct 9, 2024 · updated Aug 3, 2026 · mozilla firefox

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 9, 2024 · Catalog

    Detected

    An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

  2. Oct 15, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Nov 5, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 3, 2026 · Catalog

    Updated

    An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Nov 5, 2024

Affected

  • cpe debian/debian linux11.0
  • cpe mozilla/firefoxversion unspecified
  • cpe mozilla/thunderbirdversion unspecified
  • cpe mozilla/thunderbird131.0
  • vendor Mozilla Firefoxversion unspecified

Sources

  • CISA KEVCVE-2024-9680

    Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.

    cisa.gov
  • CVE.orgCVE-2024-9680

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-9680

    30-day exploitation probability 23.2%

    first.org
  • NIST NVDCVE-2024-9680

    An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 1

    nvd.nist.gov

References