CVE-2024-6604: Mozilla Firefox Memory Safety RCE Vulnerability

CVE-2024-6604 Overview

CVE-2024-6604 covers a set of memory safety bugs affecting Mozilla Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Mozilla developers identified evidence of memory corruption in these issues. With sufficient effort, attackers could potentially leverage these flaws to execute arbitrary code in the context of the targeted application.

The vulnerability affects Firefox versions earlier than 128, Firefox ESR earlier than 115.13, and Thunderbird earlier than both 115.13 and 128. The flaw is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact
Successful exploitation could lead to arbitrary code execution within the browser or mail client process, requiring only that a user visit a crafted page or open a malicious message.

Affected Products

Mozilla Firefox versions prior to 128
Mozilla Firefox ESR versions prior to 115.13
Mozilla Thunderbird versions prior to 115.13 and prior to 128

Discovery Timeline

2024-07-09 - CVE-2024-6604 published to NVD
2025-04-04 - Last updated in NVD database

Technical Details for CVE-2024-6604

Vulnerability Analysis

CVE-2024-6604 aggregates multiple memory safety bugs found across Mozilla's Gecko-based products. Mozilla engineers and community contributors discovered these issues during routine development and fuzzing. Several of the bugs demonstrated observable memory corruption during testing.

Memory corruption in browser engines typically arises from incorrect bounds handling, lifetime tracking errors, or unchecked allocations across the rendering, JavaScript, and networking subsystems. The classification as [CWE-120] indicates buffer copy operations performed without proper input size validation. Attackers who can shape memory layout reliably may convert such corruption into control-flow hijacking.

Referenced bug reports 1748105, 1837550, and 1884266 track the individual defects rolled up into this CVE. Mozilla addressed them collectively in Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128.

Root Cause

The root cause is improper memory safety enforcement in native C++ code paths within Firefox and Thunderbird. Specific defects include buffer copy operations that do not validate destination size against input length. These conditions enable out-of-bounds writes that corrupt adjacent memory structures used by the browser process.

Attack Vector

Exploitation requires user interaction over the network. An attacker hosts a crafted web page or delivers a malicious HTML email that triggers the vulnerable code path when rendered. Successful exploitation yields code execution within the renderer or mail client process. Sandboxing in Firefox limits initial impact, but the bugs may chain with sandbox escapes for full system compromise.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-6604

Indicators of Compromise

Unexpected child process spawning from firefox.exe or thunderbird.exe, particularly shells, powershell.exe, or scripting interpreters.
Browser or mail client crashes followed by anomalous outbound network connections to unfamiliar hosts.
Creation of persistence artifacts (scheduled tasks, registry Run keys, startup files) after rendering a web page or email.

Detection Strategies

Inventory installed Firefox, Firefox ESR, and Thunderbird versions across the fleet and flag instances running below the patched releases.
Hunt for process trees where Mozilla applications spawn LOLBins or unsigned binaries, which is unusual under normal operation.
Correlate browser crash telemetry with subsequent file write or network activity in the same user session.

Monitoring Recommendations

Forward endpoint process, file, and network telemetry to a centralized analytics platform for retrospective hunting.
Monitor egress traffic from browser processes to newly registered or low-reputation domains.
Track Mozilla auto-update events and alert when endpoints remain on vulnerable builds beyond a defined SLA.

How to Mitigate CVE-2024-6604

Immediate Actions Required

Update Firefox to version 128 or later on all managed endpoints.
Update Firefox ESR to 115.13 or later for environments standardized on the extended support release.
Update Thunderbird to 115.13 or 128 or later, depending on the deployed branch.
Restart browser and mail client processes after patching to ensure the updated binaries are loaded.

Patch Information

Mozilla published fixes in security advisories MFSA-2024-29, MFSA-2024-30, MFSA-2024-31, and MFSA-2024-32. Detailed bug references are available in the Mozilla Bug Reports tracker.

Workarounds

Restrict browsing to trusted sites and disable HTML rendering in Thunderbird where feasible until patching is complete.
Enforce strict Content Security Policy and ad-blocking at the network perimeter to reduce exposure to malicious payloads.
Apply application allowlisting to prevent unauthorized child processes from launching from Mozilla applications.

bash

# Configuration example: enforce minimum Firefox version via enterprise policy (policies.json)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "OverrideFirstRunPage": "",
    "DisableTelemetry": false
  }
}