# CVE-2024-9680

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

- Page: https://www.vulneraibility.com/cve/CVE-2024-9680
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2024-10-15; CISA due date 2024-11-05; known ransomware use
- EPSS: 23.18%
- Unvetted proof-of-concept code on GitHub: 3 GitHub proofs of concept (first 2024-10-17)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-10-09)
- Weakness: CWE-416
- Published: 2024-10-09

## Affected versions

- Mozilla Firefox: affected < 131.0.2
- Mozilla Firefox ESR: affected < 128.3.1; < 115.16.1
- Mozilla Thunderbird: affected < 131.0.1; < 128.3.1; < 115.16.0

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://bugzilla.mozilla.org/show_bug.cgi?id=1923344
- [other] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039
- [other] https://www.mozilla.org/security/advisories/mfsa2024-51/
- [other] https://www.mozilla.org/security/advisories/mfsa2024-52/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680
- [other] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992
- [other] https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html
- [other] https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.