October 15, 2024 · Applied Cybernetics Group
CVE-2024-9680 — Mozilla Firefox
known ransomware use
Mozilla Firefox Use-After-Free Vulnerability
- Added to KEV
2024-10-15- Federal due date
2024-11-05- Vendor
- Mozilla
- Product
- Firefox
- EPSS
- 97.7th percentile (score 0.232, as of
2026-09-16) - NVD CVSS v3.1
- 9.8 (CRITICAL)
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2024-9680
CISA short description
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
NVD description
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.