CVE-2024-2615 is memory safety bugs in Firefox 123, scored Critical at 9.8, fixed in Firefox 124. Severity is Critical at 9.8. Update to Firefox 124 or later. The sections below cover affected versions, checks and next steps.
What's affected
- Firefox before 124 is affected, with the bugs present in Firefox 123.
- Firefox 124 is the fixed version, per MFSA 2024-12.
- Mozilla labels the impact as critical in its advisory, and the NVD score is 9.8, so the sources agree on severity.
The NVD record gives a CVSS score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Published 2024-03-19.
How to check if you're exposed
- Help, then About Firefox shows the version.
firefox --versionprints it from a terminal.- On Debian or Ubuntu use
dpkg -l | grep -i firefox; on Fedora or RHEL userpm -q firefox. - Check Flatpak and Snap builds separately, since they update independently of system packages.
What to do now
- Update Firefox to 124 or later across managed endpoints.
- Confirm the update with your device management tool and list any machines still on 123 or earlier.
- Restart the browser so the new code loads.
- Keep automatic updates on.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
Mozilla says some of the bugs showed evidence of memory corruption, and it presumes that with enough effort some could be exploited to run arbitrary code. The advisory does not report any attack, and the KEV flag in the record is false. The vector shows a network attack needing no privileges or user interaction, which drives the 9.8 score.
Memory safety bugs are a class of mistake where code reads or writes memory it should not. Browsers are written largely in languages that allow this, and they process hostile content all day, which is why rollups like this appear in nearly every release.
The record tags the weakness as CWE-787. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Browsers are a good case for update discipline rather than case by case triage, because the next release usually fixes a new set of memory bugs.
Patching a browser is rarely a one step job in a managed fleet. Teams often find machines that were offline during the rollout, portable installs in user folders, and kiosk or lab machines on a separate update channel. A short inventory query that lists browser versions across devices is more useful than waiting for users to restart on their own. Set a target date, find the machines that miss it, and follow up on those first.
Quick check
Was this exploited in the wild?
The record's KEV flag is false and Mozilla's advisory does not describe attacks. It says only that some bugs could be exploited with enough effort.
Sources
Last reviewed: 19 October 2026.
