CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2024-4367
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Severity
- EPSS
- 71% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-754
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- mozilla:firefox
- mozilla:thunderbird
- open-xchange:open-xchange_appsuite_frontend
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wgrm-67xf-hhpq | npm | pdfjs-dist | <4.2.67 | 4.2.67 |