How to Fix CVE-2024-9680: Use-After-Free Code Execution in Firefox and Thunderbird

Update now. CVE-2024-9680 was already being exploited in the wild when Mozilla shipped the fix on 9 October 2024. CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-15 with a federal remediation deadline of 2024-11-05. Every desktop running an affected Firefox or Thunderbird build is a target: the bug fires from ordinary web content or remote email content, with no user click beyond loading the page.

What is CVE-2024-9680?

CVE-2024-9680 is a use-after-free (CWE-416) in Mozilla's Animation timeline code. When an Animation timeline object is freed but a dangling reference to it is still used, an attacker who controls the surrounding script can groom the freed memory and steer execution. Mozilla's own words from advisory MFSA 2024-51/52: “An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.” This is remote code execution — not a crash, not an information leak, not a generic “memory corruption” abstraction.

The flaw lives in Gecko, the rendering engine shared by Firefox and Thunderbird, which is why the same CVE spans both products. In Firefox, the trigger is a malicious or compromised web page. In Thunderbird, it is remote HTML content rendered inside a message. Because the vulnerable code runs whenever the engine processes the crafted content, the CVSS vector is AV:N/AC:L/PR:N/UI:N — network-reachable, low complexity, no privileges, no user interaction. That combination is what pushes the base score to 9.8.

One important nuance for Windows administrators: the code execution achieved by CVE-2024-9680 lands inside Firefox's sandboxed content process. ESET, which discovered the live exploit (credited to Damien Schaeffer), reported that the attackers chained it with a second flaw, CVE-2024-49039, a Windows Task Scheduler sandbox escape, to break out of the content process and run code with the user's full privileges. On Windows you should treat both CVEs as a single patch event.

Who is affected

You are affected if you run any of these below the patched build:

• Firefox earlier than 131.0.2 (the standard rapid-release channel).
• Firefox ESR earlier than 128.3.1 (the current ESR line) or earlier than 115.16.1 (the legacy 115 ESR line).
• Thunderbird earlier than 131.0.1, 128.3.1, or 115.16.0 depending on which channel you track.

This is desktop software on user endpoints, not a server appliance. There is no “internet-facing instance” or HA pair to reason about. The exposed surface is every laptop and workstation where a person opens web pages in Firefox or reads HTML mail in Thunderbird. Managed fleets, kiosk machines, and locked-down ESR deployments are squarely in scope because the bug needs nothing more than the browser engine doing its normal job.

How to fix CVE-2024-9680

The fix is to move to a patched build. Mozilla ships these through the application's own updater, so for most users the remediation is “let it update and restart.”

Update Firefox

1. Open the menu (≡) → Help → About Firefox. Firefox checks for, downloads, and stages the update automatically.
2. Click Restart to update Firefox when prompted.
3. Re-open About Firefox and confirm the version is 131.0.2 or later (rapid release), 128.3.1 or later (current ESR), or 115.16.1 or later (legacy ESR).

If background updates are disabled by policy, fetch the patched installer directly from Mozilla and run it over the existing install; it preserves the profile.

Update Thunderbird

1. Open Help → About Thunderbird. The update downloads automatically.
2. Click Restart to update, then re-open the About dialog to confirm 131.0.1, 128.3.1, or 115.16.0 or later.

Windows: also patch CVE-2024-49039

The in-the-wild chain escaped the Firefox sandbox using a Windows Task Scheduler flaw. Apply the November 2024 Windows cumulative update that addresses CVE-2024-49039 in addition to updating Firefox/Thunderbird. Without it, a content-process compromise on an unpatched Windows host can still be escalated.

# Check installed Firefox / Thunderbird versions on Windows
(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion
(Get-Item "C:\Program Files\Mozilla Thunderbird\thunderbird.exe").VersionInfo.ProductVersion

# Confirm the Windows update that fixes the paired sandbox escape (CVE-2024-49039) is present
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Enterprise and managed fleets

Mozilla publishes packaged installers (MSI for Windows, PKG for macOS, tar.bz2 for Linux) for ESR. Push the patched ESR build through your existing software-deployment channel — Microsoft Intune, SCCM/ConfigMgr, Jamf, or your Linux configuration manager. On Linux, the distribution package is the right source rather than a hand-rolled upgrade; for example Debian published the fix through its LTS security stream:

# Debian / Ubuntu: the distro ships the patched Firefox ESR via the security repo.
# Confirm your sources include the security suite, then:
sudo apt update
sudo apt install --only-upgrade firefox-esr   # package is firefox-esr on Debian, not "firefox"

# Verify the installed ESR version is at or above 128.3.1 (or 115.16.1 on the legacy line)
apt-cache policy firefox-esr

References for the distribution fixes are in the advisory list: Debian LTS announced it in DLA messages, and FreeBSD tracked it in bug 281992.

Verify the fix landed

1. Check the running version. Use About Firefox / About Thunderbird, or the PowerShell probe above. It must be at or above the patched build for your channel.
2. Restart the application. The new binary is not active until Firefox or Thunderbird is fully restarted — a staged update sitting un-applied still runs the vulnerable code.
3. Re-scan. If you run an endpoint vulnerability scanner (Nessus, Qualys, Tenable, Defender for Endpoint), confirm CVE-2024-9680 no longer flags on the host.
4. On Windows, confirm CVE-2024-49039 is also closed so a sandbox escape cannot follow a content-process compromise.

If you can't update immediately

There is no Mozilla-published configuration toggle that disables Animation timelines, so the patch is the real remediation. Until you update, reduce the attack surface:

• Block remote content in Thunderbird. Settings → Privacy & Security → uncheck “Allow remote content in messages.” This stops a malicious email from auto-rendering the hostile content.
• Limit browsing on unpatched Firefox. Avoid untrusted sites; a script-blocking extension reduces, but does not eliminate, the chance of reaching the vulnerable code path.
• Prioritise internet-connected machines. Since the bug triggers from ordinary web traffic, any workstation that browses the web is exposed — there is no “internal only” safe zone here.

Because the exploit was found in active use, assume that an unpatched, web-browsing endpoint may already have been targeted. After updating, review the host for unfamiliar processes, new scheduled tasks (the CVE-2024-49039 escape abuses Task Scheduler), and unexpected outbound connections.

References

• Official vendor advisory: https://bugzilla.mozilla.org/show_bug.cgi?id=1923344
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-9680
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV entry: "Mozilla Firefox Use-After-Free Vulnerability" - added 2024-10-15

Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other flaws in this area worth reviewing while you patch this one:

• How to Fix CVE-2024-45519: Actively Exploited Zimbra RCE
• How to Fix CVE-2024-42448: Remote Code Execution in Service Provider Console
• How to Fix CVE-2024-6047: Command Injection in GV_DSP_LPR_V2
• How to Fix CVE-2024-51378: CyberPanel Authentication Bypass
• How to Fix CVE-2024-39891: Twilio Authy Information Disclosure