CVE-2024-0745 Overview
CVE-2024-0745 is a stack buffer overflow vulnerability in the WebAudio OscillatorNode object in Mozilla Firefox versions prior to 122. An attacker can trigger the overflow by serving crafted web content that invokes the affected WebAudio API. Exploitation requires user interaction, such as visiting a malicious page, and can result in a potentially exploitable crash. The flaw affects confidentiality, integrity, and availability of the browser process. Mozilla addressed the issue in Firefox 122 through security advisory MFSA-2024-01. The weakness is tracked under [CWE-121] (Stack-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write).
Critical Impact
A remote attacker can trigger a stack buffer overflow in the Firefox content process by enticing a user to load malicious web content using the WebAudio OscillatorNode API, leading to a potentially exploitable crash.
Affected Products
- Mozilla Firefox versions earlier than 122
- Firefox WebAudio OscillatorNode implementation
- Desktop builds of Firefox on Windows, macOS, and Linux
Discovery Timeline
- 2024-01-23 - CVE-2024-0745 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0745
Vulnerability Analysis
The vulnerability resides in the WebAudio implementation in Firefox, specifically within the OscillatorNode object. OscillatorNode generates periodic waveforms used in audio synthesis through the Web Audio API. The implementation allocates a fixed-size buffer on the stack to process oscillator data. Under specific conditions, the code writes beyond the bounds of this stack buffer, corrupting adjacent stack memory.
Stack-based buffer overflows can overwrite return addresses, saved frame pointers, and local variables. Attackers controlling the overflow contents may be able to influence program flow within the content process. Mozilla classifies the resulting crash as potentially exploitable, indicating that memory safety mitigations may not fully contain the corruption.
Root Cause
The root cause is improper bounds checking when writing oscillator sample data to a fixed-size stack buffer in the WebAudio subsystem. The issue maps to [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write. Technical details of the defect are tracked in Mozilla Bug 1871838.
Attack Vector
An attacker hosts a malicious web page that creates an AudioContext, instantiates an OscillatorNode, and supplies inputs that trigger the out-of-bounds write. The user must visit the page or load embedded content, satisfying the user interaction requirement. Because the WebAudio API is reachable from any origin without special permissions, drive-by exploitation through advertising networks, iframes, or compromised sites is feasible. Refer to the Mozilla Security Advisory MFSA-2024-01 for vendor details.
Detection Methods for CVE-2024-0745
Indicators of Compromise
- Unexpected Firefox content process crashes with stack corruption signatures in crash telemetry or about:crashes
- Browser child process termination correlated with visits to untrusted URLs hosting WebAudio content
- Outbound connections from Firefox processes to unfamiliar domains immediately following crash events
Detection Strategies
- Inventory installed Firefox versions across the environment and flag any build earlier than 122 as vulnerable
- Monitor endpoint telemetry for abnormal child process spawning or memory access violations originating from firefox.exe or platform equivalents
- Inspect web proxy and DNS logs for users loading pages that aggressively invoke the WebAudio API from low-reputation domains
Monitoring Recommendations
- Forward Firefox crash reports and EDR process telemetry to a centralized analytics platform for correlation
- Alert on repeated content process crashes on the same host within a short time window
- Track patch compliance metrics for Firefox to ensure version 122 or later is deployed enterprise-wide
How to Mitigate CVE-2024-0745
Immediate Actions Required
- Upgrade all Firefox installations to version 122 or later as published in MFSA-2024-01
- Enforce automatic browser updates through enterprise policy or configuration management
- Restrict execution of unmanaged or out-of-date Firefox binaries on corporate endpoints
Patch Information
Mozilla fixed CVE-2024-0745 in Firefox 122. Administrators should validate the installed version via about:support or query the registry and package manager. Mozilla's advisory MFSA-2024-01 lists all coordinated fixes shipped in this release. The underlying code change is referenced in Mozilla Bug 1871838.
Workarounds
- Block or sandbox WebAudio-heavy content from untrusted origins using browser group policy or content filtering at the proxy layer
- Deploy browser isolation or remote browser solutions for high-risk users until patching completes
- Restrict outbound browsing on unpatched endpoints to a vetted allowlist of trusted domains
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
