PatchTheCVECVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability
100
Patch now
CRITICAL 9.8EXPLOITEDREMOTEWATCHLISTUPGRADEUPGRADEMITIGATE
CVE-2024-9680 is a critical-severity flaw (CVSS 9.8) affecting firefox, thunderbird, debian linux, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
Why this priority
- Critical severity
- EPSS top 2%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Used in ransomware campaigns
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 23.2% (top 2%) |
| CISA exploited list | Yes, fix due 2024-11-05, used in ransomware |
| Weakness | CWE-416 |
| Published | 2024-10-09 |
| Last modified | 2026-08-04 |
Last updated 2026-08-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
mozilla firefox UPGRADE
Affected: < 115.16.1 · < 131.0.2 · >= 128.1.0 and < 128.3.1
Fixed in: 115.16.1, 128.3.1, 131.0.2
Safe to downgrade to: a release before 128.1.0
1. Check installed version
apt-cache policy firefox || rpm -q firefox || firefox --version
2. UPGRADE to 115.16.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade firefox
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade firefox
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 128.1.0 (Debian / Ubuntu)
apt-cache madison firefox
sudo apt install firefox=<VERSION_BEFORE_128.1.0>
sudo apt-mark hold firefox
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list firefox
sudo dnf downgrade firefox-<VERSION_BEFORE_128.1.0>
sudo dnf versionlock add firefox
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
mozilla thunderbird UPGRADE
Affected: < 115.16.0 · >= 128.0.1 and < 128.3.1 · 131.0
Fixed in: 115.16.0, 128.3.1
Safe to downgrade to: a release before 128.0.1
1. Check installed version
apt-cache policy thunderbird || rpm -q thunderbird || thunderbird --version
2. UPGRADE to 115.16.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade thunderbird
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade thunderbird
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 128.0.1 (Debian / Ubuntu)
apt-cache madison thunderbird
sudo apt install thunderbird=<VERSION_BEFORE_128.0.1>
sudo apt-mark hold thunderbird
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list thunderbird
sudo dnf downgrade thunderbird-<VERSION_BEFORE_128.0.1>
sudo dnf versionlock add thunderbird
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
debian debian linux MITIGATE
Affected: 11.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora ELN · gram_grep · FIXED · 0.10.4-1.eln159 · FEDORA-2026-0808475f2a · source
sudo dnf upgrade --advisory=FEDORA-2026-0808475f2a
Fedora 46 · wesnoth · FIXED · 1.19.29-1.fc46 · FEDORA-2026-58f458e24e · source
sudo dnf upgrade --advisory=FEDORA-2026-58f458e24e
Ubuntu 22.04 · firefox · NOT AFFECTED
Ubuntu 24.04 · firefox · NOT AFFECTED
Ubuntu 20.04 · firefox · FIXED · 131.0.2+build1-0ubuntu0.20.04.1
sudo apt update && sudo apt install --only-upgrade firefox
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox)" ge "131.0.2+build1-0ubuntu0.20.04.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.10 · firefox · NOT AFFECTED
Ubuntu 24.04 · thunderbird · NOT AFFECTED
Debian 12 · firefox-esr · FIXED · 128.3.1esr-1~deb12u1
sudo apt update && sudo apt install --only-upgrade firefox-esr
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "128.3.1esr-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · firefox-esr · FIXED · 128.3.1esr-1
sudo apt update && sudo apt install --only-upgrade firefox-esr
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "128.3.1esr-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · thunderbird · FIXED · 1:115.16.0esr-1~deb12u1
sudo apt update && sudo apt install --only-upgrade thunderbird
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:115.16.0esr-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · thunderbird · FIXED · 1:128.3.2esr-1
sudo apt update && sudo apt install --only-upgrade thunderbird
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:128.3.2esr-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 7 Extended Lifecycle Support · firefox · FIXED · firefox-128.3.1-2.el7_9
sudo dnf upgrade --advisory=RHSA-2024:8034
rpm -q firefox
RHEL 8 · firefox · FIXED · firefox-128.3.1-2.el8_10
sudo dnf upgrade --advisory=RHSA-2024:7977
rpm -q firefox
RHEL 8 · thunderbird · FIXED · thunderbird-128.3.1-1.el8_10
sudo dnf upgrade --advisory=RHSA-2024:8024
rpm -q thunderbird
RHEL 8.2 Advanced Update Support · thunderbird · FIXED · thunderbird-128.3.1-1.el8_2
sudo dnf upgrade --advisory=RHSA-2024:8030
rpm -q thunderbird
RHEL 8.2 Advanced Update Support · firefox · FIXED · firefox-128.3.1-2.el8_2
sudo dnf upgrade --advisory=RHSA-2024:8176
rpm -q firefox
Alpine 3.21 · mozjs · FIXED · mozjs-128.3.1-r0
apk add --upgrade mozjs
apk info -v mozjs
Alpine 3.22 · mozjs · FIXED · mozjs-128.3.1-r0
apk add --upgrade mozjs
apk info -v mozjs
Alpine 3.23 · mozjs · FIXED · mozjs-128.3.1-r0
apk add --upgrade mozjs
apk info -v mozjs
Alpine 3.24 · mozjs · FIXED · mozjs-128.3.1-r0
apk add --upgrade mozjs
apk info -v mozjs
sudo yum update --advisory=ALAS2-2024-2690
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: tdonaworth/Firefox-CVE-2024-9680 (11 stars)
- GitHub PoC: moscovium-mc/Tor-0day-JavaScript-Exploit (10 stars)
- GitHub PoC: PraiseImafidon/Version_Vulnerability_Scanner (1 stars)
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-9680?
firefox: upgrade to 115.16.1, 128.3.1, 131.0.2; thunderbird: upgrade to 115.16.0, 128.3.1; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2024-9680 being exploited?
Yes. CVE-2024-9680 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2024-9680 affect?
CVE-2024-9680 affects firefox, thunderbird, debian linux. Severity is critical (CVSS 9.8). An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2
How urgent is CVE-2024-9680?
Priority 100/100. Critical severity; EPSS top 2%: very likely to be exploited; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Debian vulnerabilities · Mozilla Firefox vulnerabilities · Mozilla Thunderbird vulnerabilities
Related CVEs
- CVE-2026-74990 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
- CVE-2026-74989 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox 153
- CVE-2026-74988 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 153.0 and Firefox 153
- CVE-2026-74987 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
- CVE-2026-74969 HIGH 8.8 UPGRADE UPGRADE Race condition, use-after-free in the Layout: Text and Fonts component