CVE-2024-0744 is a high severity flaw in Firefox JIT compiled code, scored 7.5 by NVD and rated High by Mozilla. JIT code could dereference a wild pointer and cause an exploitable crash. Mozilla fixed it in Firefox 122, so update to that version or later.
What's affected
The record says Firefox before 122 is affected, and Mozilla advisory mfsa2024-01 of 23 January 2024 lists the fix in Firefox 122. The advisory lists no ESR or Thunderbird fix for this CVE, and the record names only Firefox. The weakness is CWE-119, improper restriction of operations within the bounds of a memory buffer. Mozilla credits the report to Lukas Bernhard.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Severity agrees across sources: NVD gives 7.5 (High) and Mozilla rates the issue High.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version. It will also start an update check. For a scripted check, the command line reports it:
firefox --version
On Debian or Ubuntu systems that use the distribution package, dpkg -l firefox-esr thunderbird lists the installed package versions. Distribution packages carry their own version strings, so read the distributor's advisory for the mapping.
Browsers are also embedded in other tools, so look beyond the desktop icon. Kiosks, managed images and portable copies often lag behind.
What to do now
- Update Firefox, Firefox ESR or Thunderbird to a fixed version listed above.
- Restart the application. Updates apply fully only after a restart.
- In managed fleets, push the update through your software management tool and report on machines that have not restarted.
- If you cannot update at once, reduce risk by avoiding untrusted sites and by not opening untrusted mail attachments or links in Thunderbird.
- Keep automatic updates on so the next Mozilla security advisory reaches users without a ticket.
Why it matters
A JIT compiler turns hot JavaScript into machine code while the page runs. Mistakes in the generated code can lead the program to use a pointer that does not point to valid memory. Mozilla says that could lead to an exploitable crash.
The record scores impact on availability only, which is why the NVD figure is 7.5 rather than higher. Memory handling bugs in JIT code are watched closely because the code runs with the browser's content process rights, so staying on current releases is the control that matters.
The record does not mark this CVE as known exploited, and the Mozilla advisories I read do not say it has been used in attacks. Browser vulnerabilities are patched in bulk each cycle, so the right habit is to keep the whole fleet current rather than track single CVEs.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Does this affect Firefox ESR?
The Mozilla advisory lists the fix only in Firefox 122 for this CVE, and the record names only Firefox.
Is a wild pointer the same as a buffer overflow?
No. A wild pointer points to memory that is not valid, which may be unmapped or reused. The record classes it under the memory bounds weakness.
Sources
Last reviewed: 19 October 2026.
