CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-9680
Critical (9.8) in Mozilla Firefox. In CISA KEV since 2024-10-15, with known ransomware use. EPSS 23% chance of exploitation in the next 30 days.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
Severity
- EPSS
- 23% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2024-10-15, due 2024-11-05, known ransomware use
- CWE
- CWE-416
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- mozilla:firefox
- mozilla:thunderbird