CVE-2024-0743 is a high severity flaw in the TLS handshake code of Firefox, Firefox ESR and Thunderbird, scored 7.5 by NVD and rated High by Mozilla. It is an unchecked return value that could cause an exploitable crash. Update to Firefox 122, or to ESR or Thunderbird 115.9.
What's affected
The record says the issue affects Firefox before 122, Firefox ESR before 115.9, and Thunderbird before 115.9. Mozilla advisory mfsa2024-01 (23 January 2024) lists the fix in Firefox 122. A later advisory, mfsa2024-13, lists Firefox ESR 115.9, which matches the record. Thunderbird 115.9 comes from the record and was not on the pages I read, so confirm it on Mozilla's Thunderbird advisory.
The weakness is CWE-252, an unchecked return value. Mozilla credits the report to John Schanck.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Severity agrees across sources: NVD gives 7.5 (High) and Mozilla rates the issue High.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version. It will also start an update check. For a scripted check, the command line reports it:
firefox --version
On Debian or Ubuntu systems that use the distribution package, dpkg -l firefox-esr thunderbird lists the installed package versions. Distribution packages carry their own version strings, so read the distributor's advisory for the mapping.
Browsers are also embedded in other tools, so look beyond the desktop icon. Kiosks, managed images and portable copies often lag behind.
What to do now
- Update Firefox, Firefox ESR or Thunderbird to a fixed version listed above.
- Restart the application. Updates apply fully only after a restart.
- In managed fleets, push the update through your software management tool and report on machines that have not restarted.
- If you cannot update at once, reduce risk by avoiding untrusted sites and by not opening untrusted mail attachments or links in Thunderbird.
- Keep automatic updates on so the next Mozilla security advisory reaches users without a ticket.
Why it matters
The code in question performs part of the secure connection setup. If a function reports an error and the caller does not check, the program carries on with state it should not trust. Here Mozilla says that could cause a crash that may be exploitable.
The vector says the impact is on availability, with no change to confidentiality or integrity, and no user interaction beyond connecting to a server. That is why NVD scores it as an availability issue even though Mozilla's wording mentions exploitability. Both views are in the record, so plan on a prompt update.
The record does not mark this CVE as known exploited, and the Mozilla advisories I read do not say it has been used in attacks. Browser vulnerabilities are patched in bulk each cycle, so the right habit is to keep the whole fleet current rather than track single CVEs.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Why does the fixed version differ between Firefox and ESR?
They are separate release trains. The fix reached the main release in Firefox 122 and the extended support release in 115.9.
Does the record call this exploited?
No. It is not flagged as known exploited.
Sources
Last reviewed: 19 October 2026.
