CVE-2024-3863 is a critical severity flaw in Firefox and Thunderbird on Windows, scored 9.8 by NVD. The executable file warning was not shown when downloading .xrm-ms files. It affects Firefox before 125, Firefox ESR before 115.10 and Thunderbird before 115.10, so update to those versions or later.
What's affected
Per the record, the affected versions are Firefox below 125, Firefox ESR below 115.10 and Thunderbird below 115.10. The fixed versions are therefore Firefox 125, Firefox ESR 115.10 and Thunderbird 115.10. The description adds a note that the issue only affected Windows, and that other operating systems are unaffected.
NVD gives the flaw 9.8 with a network vector, no privileges and high impact on all three areas. That score reflects a generic worst case for the download protection weakness. Mozilla's own advisories, linked in the record as MFSA 2024-18, 2024-19 and 2024-20, are the authority on how Mozilla rated it. This write-up did not fetch them, so read them before you set a priority, because Mozilla's own rating may differ from the NVD score.
The record's KEV flag is false and it contains no report of exploitation in the wild.
The NVD record is dated 2024-04-16 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a score of 9.8 (Critical). Weakness class: CWE-434.
How to check if you're exposed
In Firefox, open the menu, then Help, then About Firefox. The dialog shows the version and checks for updates. In Thunderbird, use Help, then About Thunderbird.
On Windows fleets, the product version is also visible in the installed programs list and in most endpoint management tools. A PowerShell query against the installed software inventory works too, and exact commands vary by how Firefox was installed, so use your management tool when you can.
Watch for ESR deployments. Many organisations pin Firefox ESR, and the fixed ESR build is 115.10, not 125. Check which channel each machine uses before you compare version numbers.
What to do now
- Update Firefox to 125 or later, or Firefox ESR to 115.10 or later, on all Windows machines.
- Update Thunderbird to 115.10 or later.
- Confirm that auto update is working on managed devices, and chase machines that are pinned to older builds.
- Read Mozilla security advisories 2024-18, 2024-19 and 2024-20 for the vendor's own rating and any extra notes.
- Remind users that a download warning is a safety net, and they should not open files they did not expect.
Why it matters
The weakness is unrestricted upload or download of a dangerous file type, CWE-434. Browsers warn before saving or opening file types that Windows can run. If one type is missing from the list, the warning disappears, and a user can open a risky file with less friction. The NVD description gives the specific type, .xrm-ms files.
The flaw does not run code by itself. It removes one prompt that stands between a user and a bad file, which is why the practical risk depends on user behaviour and on endpoint controls that block unexpected executables. Staying current on browser releases is the cleanest control.
Quick check
Does this affect macOS or Linux?
No. The description says only Windows was affected.
Which versions are fixed?
Firefox 125, Firefox ESR 115.10 and Thunderbird 115.10, per the version ranges in the record.
Sources
Last reviewed: 19 October 2026.
