CVE-2024-4777: High Memory Safety Bugs in Firefox 125 and Thunderbird

CVE-2024-4777 covers memory safety bugs in Firefox before 126, Firefox ESR before 115.11 and Thunderbird before 115.11. NVD scores it 8.8, high. Mozilla rates the advisory moderate. Update to Firefox 126, Firefox ESR 115.11 or Thunderbird 115.11, which carry the fix.

What's affected

Mozilla advisory MFSA 2024-21 says memory safety bugs were present in Firefox 125, Firefox ESR 115.10 and Thunderbird 115.10, and that some showed evidence of memory corruption. Mozilla presumes that with enough effort some could have been exploited to run arbitrary code. The fixed versions are Firefox 126, Firefox ESR 115.11 and Thunderbird 115.11. The affected range in the record is Firefox below 126, Firefox ESR below 115.11 and Thunderbird below 115.11.

There is a severity conflict to report. NVD gives 8.8 High with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Mozilla's advisory impact line says moderate. They measure different things, since Mozilla rates its own impact scale. Use the higher figure to set your patch priority.

The weaknesses are listed as CWE-787, out of bounds write, and CWE-416, use after free. The KEV flag is false. The advisory says the bugs could have been exploitable, which is not a report of attacks in the wild. The reporter credit in the advisory is Daniel Holbert and the Mozilla Fuzzing Team.

How to check if you're exposed

1. In Firefox, open the menu, choose Help, then About Firefox. The page shows the version and starts an update check.
2. In Thunderbird, use Help, then About Thunderbird.
3. On Linux, check distribution packages with the package manager. On Debian based systems run apt list --installed 2>/dev/null | grep -i -E "firefox|thunderbird".
4. For managed fleets, query your endpoint management tool for browser versions below the fixed numbers.

Debian published advisories for this issue through its LTS list, so distribution packages may carry a different version number with the fix backported. Check your distribution's security notice rather than the upstream number alone.

What to do now

1. Update Firefox to 126 or later, and ESR to 115.11 or later.
2. Update Thunderbird to 115.11 or later.
3. Restart the applications, since the old code stays loaded until they restart.
4. For managed fleets, push the update and report on stragglers.
5. Check bundled copies, such as Firefox embedded in kiosk images and portable installs.
6. Read the advisory for the other issues fixed in the same release.

Why it matters

Memory safety bugs let code read or write memory it should not touch. Out of bounds writes and use after free errors are the classic routes to corrupting a program's state, and in a browser, which processes untrusted web content all day, that can lead to code execution.

Mozilla found these through fuzzing, which is routine for browsers. The advisory is a bundle of many bugs, so the CVE stands for a class of issues, not one call path. Fast patching is the standard defence for browsers.

Quick check

Sources

• Mozilla Foundation Security Advisory 2024-21
• Debian LTS announcement (listed in the record, not read)
• NVD record data for CVE-2024-4777

Last reviewed: 19 October 2026.