CVE-2024-9680
CriticalExploitedPublic exploitAn attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.
Published Oct 10, 2024 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2024-9680, DLA-3914-1, DSA-5788-1, MFSA 2024-51, MFSA 2024-52, SUSE-SU-2024:3731-1, TR-24-1656, UBUNTU-CVE-2024-9680
Key Facts
Patch immediately- CVE-2024-9680 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Firefox (Mozilla), Thunderbird (Mozilla), Debian Linux and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 9, 2024 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 23% probability of exploitation in the next 30 days.
- Fixed versions are available, including Firefox 0:128.3.1-2.el7_9, Firefox 0:128.3.1-2.el8_2, Firefox 0:128.4.0-1.el9_5.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
23%
Higher than 97.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2024-9680 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Oct 15, 2024 | Nov 5, 2024 | Known |
| Industry KEV feed | Oct 9, 2024 | Nov 5, 2024 | Known |
| CIRCL KEV | Oct 15, 2024 | Nov 5, 2024 | Known |
| ENISA EUVD | Oct 15, 2024 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Products
210 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | >= unspecified | 131.0.2 |
| ThunderbirdMozilla | 131.0, >= unspecified | 115.16.0 |
| Debian LinuxDebian | 11.0 | n/a |
| mozjsalpine | See advisory | 128.3.1-r0 |
| Firefox ESRchainguard | >= unspecified | 128.3.1-r0 |
Patched Releases
Firefox
0:128.3.1-2.el7_9, 0:128.3.1-2.el8_2, 0:128.4.0-1.el9_5, 128.3.1-2.0.1.el7_9, 128.3.1-2.0.1.el8_10, 128.3.1-2.0.1.el9_4, 128.3.1-2.el8_10, 128.3.1-2.el8_10.alma.1, 128.3.1-2.el9_4, 128.3.1-2.el9_4.alma.1, 128.4.0-1.0.1.el9_5, 128.4.0-1.el9_5, 131.0.2-1, 131.0.2-r0, 131.0.2+build1-0ubuntu0.20.04.1, 131.0.2, 115.16.1, 128.3.1
Firefox ESR
115.16.1, 128.3.1, 128.3.1-r0, 128.3.1esr-1, 128.3.1esr-1~deb11u1, 128.3.1esr-1~deb12u1, 128.5.1-1.1
firefox-esr-branding-upstream
128.5.1-1.1
firefox-esr-translations-common
128.5.1-1.1
firefox-esr-translations-other
128.5.1-1.1
firefox-x11
128.3.1-2.0.1.el9_4, 128.4.0-1.0.1.el9_5
libmozjs-128-0
128.3.1-1.1
Thunderbird
115.16.0, 128.3.1, 0:128.3.1-1.el8_4, 0:128.3.1-1.el9_4, 1:115.16.0+build2-0ubuntu0.20.04.1, 1:115.16.0+build2-0ubuntu0.22.04.1, 1:115.16.0esr-1~deb11u1, 1:115.16.0esr-1~deb12u1, 1:128.3.2esr-1, 115.16.0-1.amzn2.0.1, 128.3.1-1.0.1.el8_10, 128.3.1-1.0.1.el9_4, 128.3.1-1.el8_10, 128.3.1-1.el8_10.alma.1, 128.3.1-1.el9_4, 128.3.1-1.el9_4.alma.1, 128.4.0-1.0.1.el9_5, 128.4.0-1.el9_5.alma.1, 131.0.1
MozillaFirefox
128.3.1-112.231.1, 128.3.1-150200.152.155.1, 131.0.2-1.1
MozillaFirefox-branding-upstream
128.3.1-150200.152.155.1, 131.0.2-1.1
MozillaFirefox-devel
128.3.1-112.231.1, 128.3.1-150200.152.155.1, 131.0.2-1.1
MozillaFirefox-translations-common
128.3.1-112.231.1, 128.3.1-150200.152.155.1, 131.0.2-1.1
MozillaFirefox-translations-other
128.3.1-150200.152.155.1, 131.0.2-1.1
MozillaThunderbird
128.3.0-150200.8.182.1, 128.3.1-1.1, 128.3.1-150200.8.185.1
MozillaThunderbird-openpgp-librnp
128.3.1-1.1
MozillaThunderbird-translations-common
128.3.0-150200.8.182.1, 128.3.1-1.1, 128.3.1-150200.8.185.1
MozillaThunderbird-translations-other
128.3.0-150200.8.182.1, 128.3.1-1.1, 128.3.1-150200.8.185.1
mozjs
128.3.1-r0
mozjs128
128.3.1-1.1
mozjs128-devel
128.3.1-1.1
rhel9/firefox-flatpak:flatpak
9040020240611093110.1728578272
rhel9/thunderbird-flatpak:flatpak
9040020240619093325.1728916452
Timeline
Added to Industry KEV feed
Oct 9, 2024
Publicly disclosed
Oct 10, 2024
Added to CISA KEV
Oct 15, 2024
Added to CIRCL KEV
Oct 15, 2024
Added to ENISA EUVD
Oct 15, 2024
Last updated
Aug 4, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryRHBA-2024:8183
- advisoryRHBA-2024:8186
- advisoryRHSA-2024:7958
- advisoryRHSA-2024:7977
- advisoryRHSA-2024:8024
FAQ
Common Questions.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.
Affected: Firefox (Mozilla) versions >= unspecified; Thunderbird (Mozilla) versions 131.0, >= unspecified; Debian Linux versions 11.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 9, 2024 and is known to be used in ransomware campaigns.
Yes. It was added on Oct 15, 2024 with a federal remediation due date of Nov 5, 2024.
Public exploit code is available.
Fixed versions are available, including Firefox 0:128.3.1-2.el7_9, Firefox 0:128.3.1-2.el8_2, Firefox 0:128.4.0-1.el9_5.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2024-9680 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo