CVE-2024-4770 – A use-after-free vulnerability in Firefox, Fire... (How to Fix)

Q: How do I fix CVE-2024-4770?

1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update. 4. Restart when prompted.

Q: What is the severity of CVE-2024-4770?

CVE-2024-4770 has a CVSS score of 8.8 (HIGH). A use-after-free vulnerability in Firefox, Firefox ESR, and Thunderbird occurs when saving pages to PDF with certain font styles, potentially causing application crashes. This could allow attackers to execute arbitrary code or cause denial of service. Affected users include those running vulnerable versions of these Mozilla applications.

📋 TL;DR

A use-after-free vulnerability in Firefox, Firefox ESR, and Thunderbird occurs when saving pages to PDF with certain font styles, potentially causing application crashes. This could allow attackers to execute arbitrary code or cause denial of service. Affected users include those running vulnerable versions of these Mozilla applications.

💻 Affected Systems

Products:

Firefox
Firefox ESR
Thunderbird

Versions: Firefox < 126, Firefox ESR < 115.11, Thunderbird < 115.11

Operating Systems: Windows, Linux, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations are vulnerable when using PDF saving functionality.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to full system compromise, data theft, or malware installation.

🟠

Likely Case

Application crash (denial of service) or limited memory corruption.

🟢

If Mitigated

No impact if patched or if PDF saving functionality is disabled.

🌐 Internet-Facing: MEDIUM - Requires user interaction (saving malicious page to PDF) but could be triggered via web content.

🏢 Internal Only: LOW - Requires user action and typically limited to client-side impact.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires user interaction to save a malicious page as PDF. No public exploit code is known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firefox 126+, Firefox ESR 115.11+, Thunderbird 115.11+

Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-21/

Restart Required: Yes

Instructions:

1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update. 4. Restart when prompted.

🔧 Temporary Workarounds

Disable PDF saving

all

Prevent users from saving pages as PDF through policy or configuration.

🧯 If You Can't Patch

Disable or restrict PDF saving functionality in affected applications.
Use alternative browsers/email clients until patches can be applied.

🔍 How to Verify

Check if Vulnerable:

Check application version against affected ranges: Firefox < 126, Firefox ESR < 115.11, Thunderbird < 115.11.

Check Version:

firefox --version (Linux) or Help → About Firefox (GUI)

Verify Fix Applied:

Confirm version is Firefox ≥126, Firefox ESR ≥115.11, or Thunderbird ≥115.11.

📡 Detection & Monitoring

Log Indicators:

Application crash logs mentioning PDF generation or font handling
Unexpected process termination of Firefox/Thunderbird

Network Indicators:

Unusual PDF generation requests to web servers

SIEM Query:

source="firefox.log" AND "crash" AND "pdf"

📊 Metadata

CVE ID: CVE-2024-4770

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 14, 2024

Last Updated: April 1, 2025

🔗 References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893270 Exploit,Issue Tracking,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html Mailing List
https://www.mozilla.org/security/advisories/mfsa2024-21/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-22/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-23/ Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1893270 Exploit,Issue Tracking,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html Mailing List
https://www.mozilla.org/security/advisories/mfsa2024-21/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-22/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-23/ Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4770, you might also want to check these: