CVE-2024-0755 covers memory safety bugs found in Firefox 121, Firefox ESR 115.6 and Thunderbird 115.6, scored 8.8 by NVD. Mozilla rates it Moderate. The fix is in Firefox 122, Firefox ESR 115.7 and Thunderbird 115.7, so update all three and restart them.
What's affected
The record says Firefox before 122, Firefox ESR before 115.7 and Thunderbird before 115.7 are affected, naming 121 and 115.6 as the versions where the bugs were present. Mozilla advisory mfsa2024-01 lists the fix as Firefox 122, Firefox ESR 115.7 and Thunderbird 115.7, and advisory mfsa2024-02 confirms ESR 115.7. The weakness is CWE-94. Mozilla credits the Mozilla Fuzzing Team along with Daniel Holbert and Andrew Osmond.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Source conflict: NVD gives 8.8 (High) while Mozilla rates the issue Moderate. Mozilla says some of these bugs showed evidence of memory corruption. Use the higher score for planning.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version. It will also start an update check. For a scripted check, the command line reports it:
firefox --version
On Debian or Ubuntu systems that use the distribution package, dpkg -l firefox-esr thunderbird lists the installed package versions. Distribution packages carry their own version strings, so read the distributor's advisory for the mapping.
Browsers are also embedded in other tools, so look beyond the desktop icon. Kiosks, managed images and portable copies often lag behind.
What to do now
- Update Firefox, Firefox ESR or Thunderbird to a fixed version listed above.
- Restart the application. Updates apply fully only after a restart.
- In managed fleets, push the update through your software management tool and report on machines that have not restarted.
- If you cannot update at once, reduce risk by avoiding untrusted sites and by not opening untrusted mail attachments or links in Thunderbird.
- Keep automatic updates on so the next Mozilla security advisory reaches users without a ticket.
Why it matters
Mozilla's wording in the record is careful: some of these bugs showed evidence of memory corruption, and they presume that with enough effort some could be exploited to run arbitrary code. These are the bug batches Mozilla publishes every release as its fuzzing and engineering teams find them.
That is why the entry lists the bugs by tracking number rather than by one cause. The practical advice is simple. Memory safety bugs in a browser engine are fixed as a group, and a user who stays within one release of the latest will have them. The bug list link below is the place to read what was fixed.
The record does not mark this CVE as known exploited, and the Mozilla advisories I read do not say it has been used in attacks. Browser vulnerabilities are patched in bulk each cycle, so the right habit is to keep the whole fleet current rather than track single CVEs.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Why is this one entry for many bugs?
Mozilla groups the memory safety fixes of a release under one CVE and links the bug list.
Is there evidence of exploitation?
Mozilla says some bugs showed signs of memory corruption and presumes exploitation might be possible with effort. It does not report attacks.
Sources
Last reviewed: 19 October 2026.
