CVE-2024-4367
MediumPublic exploitPDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Published May 15, 2024 · Updated Oct 7, 2026 · Also known as 8ce7aa01-7e79-4048-a84d-fcb9541d5f8b, DEBIAN-CVE-2024-4367, DLA-3815-1, DLA-3817-1, DSA-5691-1, DSA-5693-1, DSA-5742-1, GHSA-wgrm-67xf-hhpq, MFSA 2024-22, MFSA 2024-23, ROOT-APP-NPM-CVE-2024-4367, ROOT-OS-DEBIAN-12-CVE-2024-4367, SUSE-SU-2024:1858-1, TR-24-0490, UBUNTU-CVE-2024-4367, USN-6779-1, USN-6782-1
Key Facts
Patch immediately- CVE-2024-4367 is a medium-severity vulnerability (CVSS 5.6 v3.1) affecting Firefox (Mozilla), Thunderbird (Mozilla), Open-Xchange Appsuite Frontend and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 71% probability of exploitation in the next 30 days.
- Fixed versions are available, including @rootio/pdfjs-dist 2.12.0-root.io.1, @rootio/pdfjs-dist 2.12.313-root.io.2, @rootio/pdfjs-dist 2.16.105-root.io.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS (30-day exploit likelihood)
71%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2024-4367 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Affected Products
603 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | >= unspecified | 126.0 |
| ThunderbirdMozilla | >= unspecified | 115.11.0 |
| Open-Xchange Appsuite FrontendOpen-Xchange | 7.10.6, 7.10.6-revision10, 7.10.6-revision11, 7.10.6-revision12, 7.10.6-revision13, 7.10.6-revision14, 7.10.6-revision15, 7.10.6-revision16 | 7.10.6 |
| Debian LinuxDebian | 10.0 | n/a |
| Firefox ESRchainguard | >= unspecified | 115.11.0-r0 |
Patched Releases
@rootio/pdfjs-dist
2.12.0-root.io.1, 2.12.313-root.io.2, 2.16.105-root.io.2, 2.2.0-root.io.1, 2.2.228-root.io.2, 2.2.228-root.io.3, 3.11.0-root.io.1, 3.11.174-root.io.2, 3.11.174-root.io.3
3d-flipbook-dflip-lite
1.15.6
ari-fancy-lightbox
1.3.15
bsk-pdf-manager
3.6.1
embedpress
4.0.3
Firefox
0:115.11.0-1.el7_9, 0:115.11.0-1.el8_10, 0:115.11.0-1.el9_4, 115.11.0-1.0.1.el7_9, 115.11.0-1.0.1.el8_10, 115.11.0-1.0.1.el9_4, 115.11.0-1.el8_10, 115.11.0-1.el8_10.alma.1, 115.11.0-1.el9_4.alma.1, 126.0-1, 126.0+build2-0ubuntu0.20.04.1, 126, 115.11.0, 126.0
Firefox ESR
115.11, 115.11.0-r0, 115.11.0esr-1, 115.11.0esr-1~deb10u1, 115.11.0esr-1~deb11u1, 115.11.0esr-1~deb12u1, 128.5.1-1.1
firefox-esr-branding-upstream
128.5.1-1.1
firefox-esr-translations-common
128.5.1-1.1
firefox-esr-translations-other
128.5.1-1.1
firefox-x11
115.11.0-1.0.1.el9_4
kibana-8
8.16.1-r0
libjavascriptcoregtk-4_0-18
2.52.5-150400.4.146.1, 2.52.5-150600.12.71.1, 2.52.5-160000.1.1, 2.52.5-4.63.2
libjavascriptcoregtk-4_1-0
2.52.5-150400.4.146.1, 2.52.5-150600.12.71.1, 2.52.5-160000.1.1
libjavascriptcoregtk-6_0-1
2.52.5-150400.4.146.1, 2.52.5-150600.12.71.1, 2.52.5-160000.1.1
libwebkit2gtk-4_0-37
2.52.5-150400.4.146.1, 2.52.5-150600.12.71.1, 2.52.5-160000.1.1, 2.52.5-4.63.2
libwebkit2gtk-4_1-0
2.52.5-150400.4.146.1, 2.52.5-150600.12.71.1, 2.52.5-160000.1.1
libwebkit2gtk3-lang
2.52.5-4.63.2
libwebkitgtk-6_0-4
2.52.5-150400.4.146.1, 2.52.5-150600.12.71.1, 2.52.5-160000.1.1
Thunderbird
115.11.0, 0:115.11.0-1.el7_9, 0:115.11.0-1.el8_10, 0:115.11.0-1.el9_0, 1:115.11.0-1, 1:115.11.0-1~deb10u1, 1:115.11.0-1~deb11u1, 1:115.11.0-1~deb12u1, 1:115.11.0+build2-0ubuntu0.20.04.1, 1:115.11.0+build2-0ubuntu0.22.04.1, 115.11.0-1.0.1.el7_9, 115.11.0-1.0.1.el8_10, 115.11.0-1.0.1.el9_4, 115.11.0-1.amzn2.0.1, 115.11.0-1.el8_10, 115.11.0-1.el8_10.alma.1, 115.11.0-1.el9_4, 115.11.0-1.el9_4.alma.1, 115.11
MozillaFirefox
115.11.0-112.212.1, 115.11.0-150200.152.137.2, 126.0-1.1
MozillaFirefox-branding-upstream
115.11.0-150200.152.137.2, 126.0-1.1
MozillaFirefox-devel
115.11.0-112.212.1, 115.11.0-150200.152.137.2, 126.0-1.1
MozillaFirefox-translations-common
115.11.0-112.212.1, 115.11.0-150200.152.137.2, 126.0-1.1
MozillaFirefox-translations-other
115.11.0-150200.152.137.2, 126.0-1.1
Timeline
Publicly disclosed
May 15, 2024
Last updated
Oct 7, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
- advisoryRHSA-2024:2881
- advisoryRHSA-2024:2882
- advisoryRHSA-2024:2883
- advisoryRHSA-2024:2884
- advisoryRHSA-2024:2885
FAQ
Common Questions.
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
Affected: Firefox (Mozilla) versions >= unspecified; Thunderbird (Mozilla) versions >= unspecified; Open-Xchange Appsuite Frontend versions 7.10.6, 7.10.6-revision10, 7.10.6-revision11, 7.10.6-revision12, 7.10.6-revision13, 7.10.6-revision14, 7.10.6-revision15, 7.10.6-revision16, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including @rootio/pdfjs-dist 2.12.0-root.io.1, @rootio/pdfjs-dist 2.12.313-root.io.2, @rootio/pdfjs-dist 2.16.105-root.io.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-4367 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo