CVE-2024-2614 is memory safety bugs in Firefox 123, Firefox ESR 115.8 and Thunderbird 115.8, scored High at 8.8, fixed in Firefox 124, Firefox ESR 115.9 and Thunderbird 115.9. Severity is High at 8.8. Update to Firefox 124, Firefox ESR 115.9 or Thunderbird 115.9 or later.
What's affected
- Firefox before 124.
- Firefox ESR before 115.9.
- Thunderbird before 115.9.
- Mozilla's advisories are MFSA 2024-12 for Firefox, MFSA 2024-13 for Firefox ESR and MFSA 2024-14 for Thunderbird.
- Debian also published long term support announcements that the record links, so Debian users should follow their own distribution notices.
The NVD record gives a CVSS score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Published 2024-03-19.
How to check if you're exposed
- Firefox: Help, then About Firefox, or
firefox --version. - Thunderbird: Help, then About Thunderbird, or
thunderbird --version. - Debian and Ubuntu:
dpkg -l | grep -Ei 'firefox|thunderbird'. - Fedora or RHEL:
rpm -q firefox thunderbird. - For ESR builds, confirm the version is at least 115.9.
What to do now
- Update Firefox to 124 or later, or Firefox ESR to 115.9 or later.
- Update Thunderbird to 115.9 or later.
- On distributions that backport fixes, follow the distribution notice, since the version string may differ.
- Restart the applications after updating, and confirm the version on managed devices.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
Mozilla says some of these bugs showed evidence of memory corruption, and that with enough effort some could have been exploited to run arbitrary code. That is a presumption rather than a demonstrated exploit, and the advisory does not report attacks. The Thunderbird advisory also notes that these flaws generally cannot be exploited through email because scripting is disabled when reading mail, though they may be risky in browser or browser like contexts.
The NVD record tags the weakness as CWE-787, an out-of-bounds write. Memory safety bug rollups bundle several defects, so the tag is a summary rather than a precise root cause.
The record tags the weakness as CWE-787. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
This entry is a roll up. Mozilla lists the underlying bug numbers in its advisory and in the record's Bugzilla link, so you can follow individual fixes there.
Quick check
Is Thunderbird at risk from a malicious email?
Mozilla says these flaws generally cannot be exploited through email in Thunderbird, because scripting is disabled when reading mail. Updating is still the right step.
Sources
- Mozilla advisory MFSA 2024-12 (Firefox 124)
- Mozilla advisory MFSA 2024-13 (Firefox ESR 115.9)
- Mozilla advisory MFSA 2024-14 (Thunderbird 115.9)
Last reviewed: 19 October 2026.
