CVE-2024-9680 Mozilla Firefox Use-After-Free

Q: Is CVE-2024-9680 being exploited?

Yes. Attackers have exploited CVE-2024-9680 in the wild since at least 15 Oct 2024, including in ransomware campaigns.

Q: How do I fix CVE-2024-9680?

Upgrade to a fixed version. US federal agencies must fix it by 5 Nov 2024.

Exploited in the wild Critical 9.8 Published 9 Oct 2024 Updated 4 Aug 2026

Attackers can execute arbitrary code in the content process via a use-after-free in Animation timelines, affecting Firefox and Thunderbird users.

Exploited in the wild: Since 15 Oct 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-9680?

CVE-2024-9680 is a critical use after free vulnerability in Debian Debian Linux, published on 9 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Weakness: CWE-416

Which versions are affected by CVE-2024-9680?

It affects 3 products.

Linux distribution packages (40)

`firefox` AlmaLinux:8	All versions	`128.3.1-2.el8_10.alma.1`
`thunderbird` AlmaLinux:8	All versions	`128.3.1-1.el8_10.alma.1`
`firefox` AlmaLinux:9	All versions	`128.3.1-2.el9_4.alma.1`
`firefox-x11` AlmaLinux:9	All versions	`128.3.1-2.el9_4.alma.1`
`thunderbird` AlmaLinux:9	All versions	`128.3.1-1.el9_4.alma.1`
`firefox` Red Hat:enterprise_linux:8::appstream	All versions	`0:128.3.1-2.el8_10`
`firefox-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:128.3.1-2.el8_10`
`firefox-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:128.3.1-2.el8_10`
`thunderbird` Red Hat:enterprise_linux:8::appstream	All versions	`0:128.3.1-1.el8_10`
`thunderbird-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:128.3.1-1.el8_10`
`thunderbird-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:128.3.1-1.el8_10`
`firefox` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-2.el9_4`
`firefox-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-2.el9_4`
`firefox-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-2.el9_4`
`firefox-x11` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-2.el9_4`
`thunderbird` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-1.el9_4`
`thunderbird-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-1.el9_4`
`thunderbird-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:128.3.1-1.el9_4`
`firefox` Red Hat:rhel_aus:8.2::appstream	All versions	`0:128.3.1-2.el8_2`
`firefox-debuginfo` Red Hat:rhel_aus:8.2::appstream	All versions	`0:128.3.1-2.el8_2`
`firefox-debugsource` Red Hat:rhel_aus:8.2::appstream	All versions	`0:128.3.1-2.el8_2`
`thunderbird` Red Hat:rhel_aus:8.2::appstream	All versions	`0:128.3.1-1.el8_2`
`thunderbird-debuginfo` Red Hat:rhel_aus:8.2::appstream	All versions	`0:128.3.1-1.el8_2`
`thunderbird-debugsource` Red Hat:rhel_aus:8.2::appstream	All versions	`0:128.3.1-1.el8_2`
`firefox` Red Hat:rhel_aus:8.4::appstream	All versions	`0:128.3.1-2.el8_4`
`firefox-debuginfo` Red Hat:rhel_aus:8.4::appstream	All versions	`0:128.3.1-2.el8_4`
`firefox-debugsource` Red Hat:rhel_aus:8.4::appstream	All versions	`0:128.3.1-2.el8_4`
`thunderbird` Red Hat:rhel_aus:8.4::appstream	All versions	`0:128.3.1-1.el8_4`
`thunderbird-debuginfo` Red Hat:rhel_aus:8.4::appstream	All versions	`0:128.3.1-1.el8_4`
`thunderbird-debugsource` Red Hat:rhel_aus:8.4::appstream	All versions	`0:128.3.1-1.el8_4`
`firefox` Red Hat:rhel_aus:8.6::appstream	All versions	`0:128.3.1-2.el8_6`
`firefox-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`0:128.3.1-2.el8_6`
`firefox-debugsource` Red Hat:rhel_aus:8.6::appstream	All versions	`0:128.3.1-2.el8_6`
`thunderbird` Red Hat:rhel_aus:8.6::appstream	All versions	`0:128.3.1-1.el8_6`
`thunderbird-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`0:128.3.1-1.el8_6`
`thunderbird-debugsource` Red Hat:rhel_aus:8.6::appstream	All versions	`0:128.3.1-1.el8_6`
`firefox` Red Hat:rhel_e4s:8.4::appstream	All versions	`0:128.3.1-2.el8_4`
`firefox-debuginfo` Red Hat:rhel_e4s:8.4::appstream	All versions	`0:128.3.1-2.el8_4`
`firefox-debugsource` Red Hat:rhel_e4s:8.4::appstream	All versions	`0:128.3.1-2.el8_4`
`thunderbird` Red Hat:rhel_e4s:8.4::appstream	All versions	`0:128.3.1-1.el8_4`

Products include Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird.

How do I fix CVE-2024-9680?

Upgrade to a fixed version. US federal agencies must fix it by 5 Nov 2024.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-9680 being exploited?

Yes. Attackers have exploited CVE-2024-9680 in the wild since at least 15 Oct 2024, including in ransomware campaigns.

Public exploit code: 3 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALSA-2024:7958, ALSA-2024:7977, ALSA-2024:8024, ALSA-2024:8025, DEBIAN-CVE-2024-9680, DLA-3914-1 and 29 more.