CVE-2024-9680 (GCVE-0-2024-9680)
Vulnerability from cvelistv5 – Published: 2024-10-09 12:59 – Updated: 2026-08-04 03:55Summary
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
Severity
9.8 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-09 00:00 UTC
CWE
- Use-after-free in Animation timeline
- CWE-416 - Use After Free
Assigner
References
8 references
Impacted products
9 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 131.0.2
(custom)
|
guessed | |
| Mozilla | Firefox ESR |
Affected:
unspecified , < 128.3.1
(custom)
|
guessed | |
| Mozilla | Firefox ESR |
Affected:
unspecified , < 115.16.1
(custom)
|
guessed | |
| Mozilla | Thunderbird |
Affected:
unspecified , < 131.0.1
(custom)
|
guessed | |
| Mozilla | Thunderbird |
Affected:
unspecified , < 128.3.1
(custom)
|
guessed | |
| Mozilla | Thunderbird |
Affected:
unspecified , < 115.16.0
(custom)
|
guessed | |
| mozilla | firefox |
Affected:
0 , < 131.0.2
(custom)
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
||
| mozilla | firefox_esr |
Affected:
0 , < 128.3.1
(custom)
Affected: 0 , < 115.16.1 (custom) cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
||
| mozilla | thunderbird |
Affected:
0 , < 131.0.1
(custom)
Affected: 0 , < 128.3.1 (custom) Affected: 0 , < 115.16.0 (custom) cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: fb309fb7-793a-4ef2-82c1-7d90e3278c31
Exploited: Yes
Timestamps
First Seen: 2024-10-15
Asserted: 2024-10-15
Scope
Notes: KEV entry: Mozilla Firefox Use-After-Free Vulnerability | Affected: Mozilla / Firefox | Description: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-11-05 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-416 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Firefox |
| Due Date | 2024-11-05 |
| Date Added | 2024-10-15 |
| Vendorproject | Mozilla |
| Vulnerabilityname | Mozilla Firefox Use-After-Free Vulnerability |
| Knownransomwarecampaignuse | Known |
References
Created: 2026-02-02 12:26 UTC
| Updated: 2026-02-06 07:17 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 54fa01eb-2ff6-4de9-8c60-a27024e25be0
Exploited: Yes
Timestamps
First Seen: 2024-10-15
Asserted: 2024-10-15
Scope
Notes: KEVIntel entry: An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of... | Affected: Mozilla / Firefox, Firefox ESR, Thunderbird | CVSS: 9.8 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Confirmed Compromise
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of... |
| Vendor | Mozilla |
| Product | Firefox, Firefox ESR, Thunderbird |
| Added Date | 2024-10-15T00:00:00.000Z |
| Cvss Score | 9.8 |
| Epss Score | None |
| Cvss Severity | CRITICAL |
| Epss Percentile | None |
| Used In Malware | yes |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | False |
References
Created: 2026-06-23 14:05 UTC
| Updated: 2026-07-10 06:14 UTC
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "firefox",
"vendor": "mozilla",
"versions": [
{
"lessThan": "131.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "firefox_esr",
"vendor": "mozilla",
"versions": [
{
"lessThan": "128.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "115.16.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "firefox_esr",
"vendor": "mozilla",
"versions": [
{
"lessThan": "128.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "115.16.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "thunderbird",
"vendor": "mozilla",
"versions": [
{
"lessThan": "131.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "128.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "115.16.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "thunderbird",
"vendor": "mozilla",
"versions": [
{
"lessThan": "131.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "128.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "115.16.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "thunderbird",
"vendor": "mozilla",
"versions": [
{
"lessThan": "131.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "128.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "115.16.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-9680",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-10-15",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T03:55:28.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-15T00:00:00.000Z",
"value": "CVE-2024-9680 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:33:32.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "131.0.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "128.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.16.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "131.0.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "128.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.16.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Damien Schaeffer from ESET"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0."
}
],
"value": "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Use-after-free in Animation timeline",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-18T18:21:58.377Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1923344"
},
{
"name": "Windows sandbox escape detected with the in-the-wild exploit",
"url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2024-51/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2024-52/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2024-9680",
"datePublished": "2024-10-09T12:59:07.108Z",
"dateReserved": "2024-10-09T06:28:21.295Z",
"dateUpdated": "2026-08-04T03:55:28.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2024-9680",
"cwes": "[\"CWE-416\"]",
"dateAdded": "2024-10-15",
"dueDate": "2024-11-05",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680",
"product": "Firefox",
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.",
"vendorProject": "Mozilla",
"vulnerabilityName": "Mozilla Firefox Use-After-Free Vulnerability"
},
"epss": {
"cve": "CVE-2024-9680",
"date": "2026-09-16",
"epss": "0.23184",
"percentile": "0.97652"
},
"fkie_nvd": {
"cisaActionDue": "2024-11-05",
"cisaExploitAdd": "2024-10-15",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Mozilla Firefox Use-After-Free Vulnerability",
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\", \"versionEndExcluding\": \"115.16.1\", \"matchCriteriaId\": \"45244B45-832B-4C4A-8004-8D13C331E52B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*\", \"versionEndExcluding\": \"131.0.2\", \"matchCriteriaId\": \"07E39FE8-1685-46D2-9E3E-2613F3852132\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\", \"versionStartIncluding\": \"128.1.0\", \"versionEndExcluding\": \"128.3.1\", \"matchCriteriaId\": \"C4AEB9BD-EB47-4F96-BC72-949023ACE8ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"115.16.0\", \"matchCriteriaId\": \"DB9A49A0-8233-46B2-894A-FAD4DC6ED563\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"128.0.1\", \"versionEndExcluding\": \"128.3.1\", \"matchCriteriaId\": \"F48D7DE7-477D-4026-B6BD-BFE2BC5382F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD5E6249-26BF-4E13-87D8-B15EF63A859F\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\"}, {\"lang\": \"es\", \"value\": \"Un atacante pudo ejecutar c\\u00f3digo en el proceso de contenido aprovechando un use-after-free en las l\\u00edneas de tiempo de animaci\\u00f3n. Hemos recibido informes de que esta vulnerabilidad se ha explotado de forma activa. Esta vulnerabilidad afecta a Firefox \u0026lt; 131.0.2, Firefox ESR \u0026lt; 128.3.1 y Firefox ESR \u0026lt; 115.16.1.\"}]",
"id": "CVE-2024-9680",
"lastModified": "2024-11-26T19:53:56.537",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
"published": "2024-10-09T13:15:12.090",
"references": "[{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344\", \"source\": \"security@mozilla.org\", \"tags\": [\"Issue Tracking\", \"Permissions Required\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039\", \"source\": \"security@mozilla.org\", \"tags\": [\"Not Applicable\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-51/\", \"source\": \"security@mozilla.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-52/\", \"source\": \"security@mozilla.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}]",
"sourceIdentifier": "security@mozilla.org",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-9680\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2024-10-09T13:15:12.090\",\"lastModified\":\"2026-08-04T05:16:32.530\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\"},{\"lang\":\"es\",\"value\":\"Un atacante pudo ejecutar c\u00f3digo en el proceso de contenido aprovechando un use-after-free en las l\u00edneas de tiempo de animaci\u00f3n. Hemos recibido informes de que esta vulnerabilidad se ha explotado de forma activa. Esta vulnerabilidad afecta a Firefox \u0026lt; 131.0.2, Firefox ESR \u0026lt; 128.3.1 y Firefox ESR \u0026lt; 115.16.1.\"}],\"affected\":[{\"source\":\"security@mozilla.org\",\"affectedData\":[{\"vendor\":\"Mozilla\",\"product\":\"Firefox\",\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"131.0.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Mozilla\",\"product\":\"Firefox ESR\",\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Mozilla\",\"product\":\"Firefox ESR\",\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"115.16.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Mozilla\",\"product\":\"Thunderbird\",\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"131.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Mozilla\",\"product\":\"Thunderbird\",\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Mozilla\",\"product\":\"Thunderbird\",\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"115.16.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"mozilla\",\"product\":\"firefox\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"131.0.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"mozilla\",\"product\":\"firefox_esr\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"115.16.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"mozilla\",\"product\":\"firefox_esr\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"115.16.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"mozilla\",\"product\":\"thunderbird\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"131.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"115.16.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"mozilla\",\"product\":\"thunderbird\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"131.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"115.16.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"mozilla\",\"product\":\"thunderbird\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"131.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"128.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"115.16.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-09T00:00:00+00:00\",\"id\":\"CVE-2024-9680\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2024-10-15\",\"cisaActionDue\":\"2024-11-05\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Mozilla Firefox Use-After-Free Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\",\"versionEndExcluding\":\"115.16.1\",\"matchCriteriaId\":\"45244B45-832B-4C4A-8004-8D13C331E52B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"131.0.2\",\"matchCriteriaId\":\"07E39FE8-1685-46D2-9E3E-2613F3852132\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\",\"versionStartIncluding\":\"128.1.0\",\"versionEndExcluding\":\"128.3.1\",\"matchCriteriaId\":\"C4AEB9BD-EB47-4F96-BC72-949023ACE8ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"115.16.0\",\"matchCriteriaId\":\"DB9A49A0-8233-46B2-894A-FAD4DC6ED563\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"128.0.1\",\"versionEndExcluding\":\"128.3.1\",\"matchCriteriaId\":\"F48D7DE7-477D-4026-B6BD-BFE2BC5382F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD5E6249-26BF-4E13-87D8-B15EF63A859F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344\",\"source\":\"security@mozilla.org\",\"tags\":[\"Issue Tracking\",\"Permissions Required\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039\",\"source\":\"security@mozilla.org\",\"tags\":[\"Not Applicable\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2024-51/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2024-52/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-06-29T20:27:02+00:00",
"cve": "CVE-2024-9680",
"id": "CVE-2024-9680",
"initial_release_date": "2024-10-09T14:08:00+00:00",
"product_status:fixed": "255",
"product_status:known_affected": "6",
"product_status:known_not_affected": "4",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill)",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9680.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-09-02T01:37:36Z",
"cve": "CVE-2024-9680",
"id": "CVE-2024-9680",
"initial_release_date": "2024-10-11T03:18:14Z",
"product_status:known_affected": "72",
"product_status:recommended": "220",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-9680",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-9680.json",
"version": "36"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:33:32.973Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-9680\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-16T12:58:45.687179Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2024-10-15\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"firefox\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"firefox_esr\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"firefox_esr\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-10-15T00:00:00.000Z\", \"value\": \"CVE-2024-9680 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-09T15:33:12.930Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"Damien Schaeffer from ESET\"}], \"affected\": [{\"vendor\": \"Mozilla\", \"product\": \"Firefox\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"131.0.2\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Firefox ESR\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Firefox ESR\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"115.16.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344\"}, {\"url\": \"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039\", \"name\": \"Windows sandbox escape detected with the in-the-wild exploit\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-51/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-52/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Use-after-free in Animation timeline\"}]}], \"providerMetadata\": {\"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\", \"dateUpdated\": \"2024-11-18T18:21:58.377Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-9680\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T03:55:28.598Z\", \"dateReserved\": \"2024-10-09T06:28:21.295Z\", \"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"datePublished\": \"2024-10-09T12:59:07.108Z\", \"assignerShortName\": \"mozilla\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…