CVE-2024-4367 PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Missing type check in PDF.js allows arbitrary JavaScript execution, requiring users to upgrade Firefox and Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4367?
CVE-2024-4367 is a medium-severity code injection vulnerability in Debian Debian Linux, published on 14 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Weakness: CWE-754
Which versions are affected by CVE-2024-4367?
2 open source packages ship an affected version, including pdfjs-dist. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
pdfjs-dist npm | All versions | 4.2.67 |
pdfjs-dist npm | All versions | 4.2.67 |
Products include Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird, Open-Xchange Open-Xchange Appsuite Frontend.
How do I fix CVE-2024-4367?
Upgrade pdfjs-dist to 4.2.67 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-4367 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4367 exists.
Public exploit code: 1 Exploit-DB entry and 29 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLSA-2026-1775089656, CLSA-2026-1788868464, DEBIAN-CVE-2024-4367, DSA-5742-1, ECHO-6650-6464-0a5f, GHSA-wgrm-67xf-hhpq and 3 more.