CVE-2024-1552 is a high severity (CVSS 7.5) flaw in Mozilla's code generation that could cause unexpected numeric conversions and undefined behavior. It only affects 32-bit ARM devices. Affected are Firefox before 123, Firefox ESR before 115.8 and Thunderbird before 115.8. Update to those releases or later.
What's affected
Mozilla's advisory covers Firefox 123, Firefox ESR 115.8 and Thunderbird 115.8, which are the first fixed releases:
- Firefox earlier than 123
- Firefox ESR earlier than 115.8
- Thunderbird earlier than 115.8
Mozilla notes that this issue only affects 32-bit ARM devices. The record also lists the Linux kernel among its products because of distribution advisories, but the flaw lives in the Mozilla applications. Debian published long term support announcements for its packages, which are listed in the record's references.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox to read the version. In Thunderbird use Help, About Thunderbird. For Linux packages you can query the package manager:
dpkg -l firefox-esr thunderbird
uname -m
The architecture output tells you whether you are on 32-bit ARM, which reads as armv7l on many boards. If you are on any other architecture the advisory says you are not affected.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Identify devices running Firefox or Thunderbird on 32-bit ARM, such as older single board computers.
- Update to Firefox 123, ESR 115.8, Thunderbird 115.8 or later.
- On Debian based systems, apply the long term support package update.
- Keep automatic updates on for browsers and mail clients.
- Plan a move to 64-bit systems for hardware that is still on 32-bit ARM.
Why it matters
The record classes this as CWE-681, incorrect conversion between numeric types. The JavaScript engine's compiler produced code that converted numbers in an unexpected way on one architecture, and the result could be undefined behavior.
Browser engine flaws can matter because web content is untrusted by design. Mozilla's own text is brief and does not describe exploitation, and the record's KEV flag is false. The narrow architecture limits how many users are exposed.
Quick check
Does this affect 64-bit Firefox?
No. Mozilla says it only affects 32-bit ARM devices.
Which releases fix it?
Firefox 123, Firefox ESR 115.8 and Thunderbird 115.8.
Sources
- Mozilla advisory MFSA 2024-05
- Mozilla bug 1874502 (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1552
Last reviewed: 19 October 2026.
