CVE-2024-2605: mozilla firefox
Vulnerability summary
CVE-2024-2605 is a medium (CVSS 5.9) vulnerability in mozilla firefox. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 8Timeline
- 19-03-2024PublishedVulnerability first disclosed.
- 13-03-2025Last modifiedVulnerability information updated.
Description
An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu6 products
- mozjs102All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
- mozjs78All versions (No fix recorded)
Mozilla3 products
- firefox≥ unspecified, < 124 | < 115.9.0 | < 124.0
- firefox_esr≥ unspecified, < 115.9
- thunderbird≥ unspecified, < 115.9 | < 115.9.0
Chainguard1 product
- firefox-esr< 115.9.1-r0
3 vendors · 10 products