CVE-2024-4770: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-4770 Overview

CVE-2024-4770 is a use-after-free vulnerability [CWE-416] in Mozilla Firefox and Thunderbird. The flaw triggers when saving a web page to PDF with specific font styles applied. An attacker can craft a malicious page that, when saved to PDF by the victim, causes a use-after-free condition leading to a crash or potential code execution.

The vulnerability affects Firefox versions prior to 126, Firefox ESR prior to 115.11, and Thunderbird prior to 115.11. Exploitation requires user interaction, specifically the user invoking the print-to-PDF action on a page controlled by the attacker.

Critical Impact
A use-after-free during PDF rendering can allow attackers to execute arbitrary code in the browser process when a user saves a malicious page to PDF.

Affected Products

Mozilla Firefox versions prior to 126
Mozilla Firefox ESR versions prior to 115.11
Mozilla Thunderbird versions prior to 115.11

Discovery Timeline

2024-05-14 - CVE-2024-4770 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4770

Vulnerability Analysis

The vulnerability resides in the PDF generation path of Firefox and Thunderbird. When the browser serializes a page to PDF, the font rendering pipeline manages glyph and style objects across multiple stages. Specific font styles cause an object to be freed while a reference to it remains live in the rendering code.

When the dangling reference is dereferenced, the freed memory may have been reallocated with attacker-influenced content. This produces a crash at minimum and can lead to arbitrary code execution if the heap layout is groomed by the attacker.

The issue is tracked under Mozilla Bug 1893270 and addressed across MFSA-2024-21, MFSA-2024-22, and MFSA-2024-23.

Root Cause

The root cause is improper lifetime management of font style objects during PDF serialization [CWE-416]. The code releases an object while another code path still holds and later uses a pointer to it.

Attack Vector

An attacker hosts a crafted web page or HTML email containing the triggering font styles. The victim must open the content and invoke the save-to-PDF action. In Thunderbird, rendering a malicious HTML message with appropriate content can reach the same vulnerable code path.

The vulnerability requires user interaction but no authentication, and can be delivered over the network through standard web or email channels.

Detection Methods for CVE-2024-4770

Indicators of Compromise

Unexpected crashes of firefox.exe or thunderbird.exe processes immediately after a print-to-PDF or save-as-PDF action.
Crash reports referencing font rendering or PDF export modules submitted to Mozilla crash telemetry.
Outbound connections from browser child processes to unfamiliar domains immediately following PDF generation.

Detection Strategies

Monitor endpoint telemetry for browser process crashes correlated with PDF file creation events in user directories.
Inventory Firefox, Firefox ESR, and Thunderbird installations across the environment and flag versions below 126 and 115.11 respectively.
Inspect HTML email content reaching Thunderbird users for unusual CSS font-style constructs targeting the print path.

Monitoring Recommendations

Track child process creation from browser processes after PDF export actions for signs of shellcode execution.
Forward browser crash dumps to a centralized location for review of access violations in font-handling stacks.
Alert on Firefox or Thunderbird builds that fall behind the patched versions through software inventory scans.

How to Mitigate CVE-2024-4770

Immediate Actions Required

Upgrade Mozilla Firefox to version 126 or later on all endpoints.
Upgrade Mozilla Firefox ESR to version 115.11 or later for managed deployments.
Upgrade Mozilla Thunderbird to version 115.11 or later on systems used for email.
Apply distribution security updates including the Debian LTS advisory for affected packages.

Patch Information

Mozilla released fixes in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Refer to MFSA-2024-21, MFSA-2024-22, and MFSA-2024-23 for vendor advisories. Debian users should consult the Debian LTS announcement for backported package versions.

Workarounds

Instruct users to avoid the save-to-PDF or print-to-PDF function on untrusted pages until patches are applied.
Configure Thunderbird to display messages in plain text to reduce exposure to malicious HTML content.
Deploy enterprise update policies that enforce automatic browser updates and block downgrades.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Example apt upgrade on Debian-based systems
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbird