9.8

CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability

CVSS: 9.8v3.1CriticalKEVRansomwareAnalyzed
AliasesMGASA-2024-0331MGASA-2024-0336SUSE-SU-2024:3731-1
Published 09-10-2024Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2024-9680 is a critical (CVSS 9.8) Use After Free vulnerability in Mozilla Firefox. It is known to be exploited: CISA lists it, first on 15-10-2024. It has been used in ransomware campaigns. EPSS estimates a 23.18% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
23.18%
0%100%
High · 0.00 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 8
DLA-3916-1DSA-5789-1MGASA-2024-0334OPENSUSE-SU-2024:14394-1OPENSUSE-SU-2024:14397-1OPENSUSE-SU-2024:14572-1

Timeline

  1. 09-10-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2024
    Added to CISA KEVMozilla Firefox Use-After-Free Vulnerability
  3. 05-11-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 04-08-2026
    Last modifiedVulnerability information updated.

Description

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

23.18%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 23.18% on 19-09-2026

19-09-202619-10-2026
EPSS score
23.18%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
15-10-2024
Federal due date
05-11-2024
Ransomware

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. www.mozilla.org/en-US/security/advisories/mfsa2024-51/ nvd.nist.gov/vuln/detail/CVE-2024-9680

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu9 products
  • firefox< 131.0.2+build1-0ubuntu0.20.04.1
  • mozjs102All versions (No fix recorded)
  • mozjs115All versions (No fix recorded)
  • mozjs38All versions (No fix recorded)
  • mozjs52All versions (No fix recorded)
Redhat7 products
  • firefox< 0:128.3.1-2.el9_4 | < 0:128.3.1-2.el8_10 | < 0:128.3.1-2.el9_2 | < 0:128.3.1-2.el9_0 | < 0:128.3.1-2.el8_8 | < 0:128.3.1-2.el7_9 | < 0:128.3.1-2.el8_6 | < 0:128.3.1-2.el8_4 | < 0:128.3.1-2.el8_2
  • firefox-debuginfo< 0:128.3.1-2.el9_4 | < 0:128.3.1-2.el8_10 | < 0:128.3.1-2.el9_2 | < 0:128.3.1-2.el9_0 | < 0:128.3.1-2.el8_8 | < 0:128.3.1-2.el7_9 | < 0:128.3.1-2.el8_6 | < 0:128.3.1-2.el8_4 | < 0:128.3.1-2.el8_2
  • firefox-debugsource< 0:128.3.1-2.el9_4 | < 0:128.3.1-2.el8_10 | < 0:128.3.1-2.el9_2 | < 0:128.3.1-2.el9_0 | < 0:128.3.1-2.el8_8 | < 0:128.3.1-2.el8_6 | < 0:128.3.1-2.el8_4 | < 0:128.3.1-2.el8_2
  • firefox-x11< 0:128.3.1-2.el9_4 | < 0:128.3.1-2.el9_2
  • thunderbird< 0:128.3.1-1.el8_10 | < 0:128.3.1-1.el9_4 | < 0:128.3.1-1.el9_2 | < 0:128.3.1-1.el9_0 | < 0:128.3.1-1.el8_6 | < 0:128.3.1-1.el8_4 | < 0:128.3.1-1.el8_2
Mageia4 products
  • firefox< 128.3.1-1.mga9
  • firefox-l10n< 128.3.1-1.mga9
  • thunderbird< 128.3.2-1.mga9
  • thunderbird-l10n< 128.3.2-1.mga9
Suse4 products
  • MozillaThunderbird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 128.3.1-150200.8.185.1
  • MozillaThunderbird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 128.3.1-150200.8.185.1
  • MozillaThunderbird&distro=SUSE Linux Enterprise Workstation Extension 15 SP5< 128.3.1-150200.8.185.1
  • MozillaThunderbird&distro=SUSE Linux Enterprise Workstation Extension 15 SP6< 128.3.1-150200.8.185.1
Debian3 products
  • firefox-esr< 128.3.1esr-1 | < 128.3.1esr-1~deb12u1 | < 128.3.1esr-1~deb11u1
  • thunderbird< 1:115.16.0esr-1~deb12u1 | < 1:128.3.2esr-1
  • debian_linuxEOL11.0
Mozilla3 products
  • firefox≥ unspecified, < 131.0.2 | < 115.16.1 | < 131.0.2 | ≥ 128.1.0, < 128.3.1
  • firefox_esr≥ unspecified, < 128.3.1 | ≥ unspecified, < 115.16.1
  • thunderbird≥ unspecified, < 131.0.1 | ≥ unspecified, < 128.3.1 | ≥ unspecified, < 115.16.0 | < 115.16.0 | ≥ 128.0.1, < 128.3.1 | 131.0
Opensuse3 products
  • MozillaFirefox&distro=openSUSE Tumbleweed< 131.0.2-1.1
  • MozillaThunderbird&distro=openSUSE Leap 15.5< 128.3.1-150200.8.185.1
  • MozillaThunderbird&distro=openSUSE Leap 15.6< 128.3.1-150200.8.185.1
Chainguard2 products
  • firefox< 131.0.2-r0
  • firefox-esr< 128.3.1-r0
Wolfi1 product
  • firefox< 131.0.2-r0

9 vendors · 36 products

References

65 links
Show all 65 references