CVE-2024-8384 – A critical memory corruption vulnerability in M... (How to Fix)

Q: How do I fix CVE-2024-8384?

1. Open the affected application. 2. Go to Help > About Firefox/Thunderbird. 3. Allow the application to check for and install updates. 4. Restart the application when prompted.

Q: What is the severity of CVE-2024-8384?

CVE-2024-8384 has a CVSS score of 9.8 (CRITICAL). A critical memory corruption vulnerability in Mozilla's JavaScript garbage collector could allow attackers to execute arbitrary code or cause denial of service. This affects Firefox, Firefox ESR, and Thunderbird when specific out-of-memory conditions occur during garbage collection passes. All users of affected versions are at risk.

📋 TL;DR

A critical memory corruption vulnerability in Mozilla's JavaScript garbage collector could allow attackers to execute arbitrary code or cause denial of service. This affects Firefox, Firefox ESR, and Thunderbird when specific out-of-memory conditions occur during garbage collection passes. All users of affected versions are at risk.

💻 Affected Systems

Products:

Firefox
Firefox ESR
Thunderbird

Versions: Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, Thunderbird < 115.15

Operating Systems: All platforms supported by affected applications

Default Config Vulnerable: ⚠️ Yes

Notes: All standard installations are vulnerable; no special configuration required for exploitation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Browser/application crash (denial of service) or limited memory corruption allowing information disclosure.

🟢

If Mitigated

No impact if patched; limited impact if exploit attempts are blocked by security controls.

🌐 Internet-Facing: HIGH - Web browsers process untrusted content from the internet, making exploitation trivial via malicious websites.

🏢 Internal Only: MEDIUM - Internal users could be targeted via phishing or compromised internal sites, but attack surface is smaller.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires triggering specific OOM conditions during garbage collection, which may be challenging but feasible for skilled attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firefox 130, Firefox ESR 128.2, Firefox ESR 115.15, Thunderbird 128.2, Thunderbird 115.15

Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-39/

Restart Required: Yes

Instructions:

1. Open the affected application. 2. Go to Help > About Firefox/Thunderbird. 3. Allow the application to check for and install updates. 4. Restart the application when prompted.

🔧 Temporary Workarounds

Disable JavaScript

all

Prevents exploitation by disabling JavaScript execution, but breaks most web functionality.

about:config > javascript.enabled = false

🧯 If You Can't Patch

Restrict access to untrusted websites and email content
Deploy application control to block execution of vulnerable versions

🔍 How to Verify

Check if Vulnerable:

Check application version against affected versions list.

Check Version:

Firefox/Thunderbird: about:support or Help > About

Verify Fix Applied:

Confirm version is equal to or greater than patched versions.

📡 Detection & Monitoring

Log Indicators:

Application crash logs with memory corruption signatures
Unexpected process termination

Network Indicators:

Traffic to known malicious domains hosting exploit code

SIEM Query:

source="firefox.log" OR source="thunderbird.log" AND (event="crash" OR event="segfault")

📊 Metadata

CVE ID: CVE-2024-8384

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: September 3, 2024

Last Updated: November 4, 2025

🔗 References

https://bugzilla.mozilla.org/show_bug.cgi?id=1911288 Issue Tracking,Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-39/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-40/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-41/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-43/
https://www.mozilla.org/security/advisories/mfsa2024-44/
https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-8384, you might also want to check these: