CVE-2024-0745 is a high severity stack buffer overflow in the Firefox WebAudio OscillatorNode, scored 8.8 by NVD. Mozilla fixed it in Firefox 122 and rates it High. Update Firefox to version 122 or later and restart the browser so the fix takes effect.
What's affected
The record says Firefox before 122 is affected. Mozilla advisory mfsa2024-01 of 23 January 2024 lists the fix in Firefox 122, with no ESR or Thunderbird fix for this CVE. The weaknesses are CWE-787 (out of bounds write) and CWE-121 (stack based buffer overflow). Mozilla credits the report to Yangkang of the 360 ATA Team.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Severity agrees across sources: NVD gives 8.8 (High) and Mozilla rates the issue High. The vector adds that user interaction is required, which in a browser usually means visiting a page.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version. It will also start an update check. For a scripted check, the command line reports it:
firefox --version
On Debian or Ubuntu systems that use the distribution package, dpkg -l firefox-esr thunderbird lists the installed package versions. Distribution packages carry their own version strings, so read the distributor's advisory for the mapping.
Browsers are also embedded in other tools, so look beyond the desktop icon. Kiosks, managed images and portable copies often lag behind.
What to do now
- Update Firefox, Firefox ESR or Thunderbird to a fixed version listed above.
- Restart the application. Updates apply fully only after a restart.
- In managed fleets, push the update through your software management tool and report on machines that have not restarted.
- If you cannot update at once, reduce risk by avoiding untrusted sites and by not opening untrusted mail attachments or links in Thunderbird.
- Keep automatic updates on so the next Mozilla security advisory reaches users without a ticket.
Why it matters
The WebAudio API lets web pages generate and process sound. A stack buffer overflow happens when code writes more data to a stack buffer than it can hold, which corrupts neighboring memory. Mozilla says it could lead to a potentially exploitable crash.
Because the code is reached from web content, the attack surface is any page a user opens. That is why the vector shows network reach with user interaction, and why the impact is rated high on all three properties. Browsers add layers like sandboxing, but you should not rely on them as a reason to delay an update.
The record does not mark this CVE as known exploited, and the Mozilla advisories I read do not say it has been used in attacks. Browser vulnerabilities are patched in bulk each cycle, so the right habit is to keep the whole fleet current rather than track single CVEs.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does a stack buffer overflow do?
It writes past the end of a fixed size buffer on the stack, which can crash the program or, in some cases, change what it runs. Mozilla describes a potentially exploitable crash.
Do I need to do anything besides updating?
Restart Firefox after the update. No other step is described by Mozilla.
Sources
Last reviewed: 19 October 2026.
