{"id":"CVE-2024-4367","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-4367","generatedAt":"2026-10-28T02:13:11.462Z","title":"A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.","description":"A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.","published":"2024-05-14T18:15:12.000Z","lastModified":"2026-06-17T08:01:46.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-754"],"affected":["mozilla/firefox","mozilla/thunderbird","debian/debian linux","open-xchange/open-xchange appsuite frontend"],"epss":{"score":0.7066,"percentile":0.9939,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2025-04-22","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":52273,"kind":"exploit","title":"Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution","url":"https://www.exploit-db.com/exploits/52273","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/52273.py","file":"exploits/multiple/remote/52273.py","published":"2025-04-22","added":"2025-04-22","updated":"2025-04-22","author":"Milad karimi","type":"remote","platform":"multiple","port":null,"verified":false,"codes":["CVE-2024-4367"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 70.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645","tags":["Issue Tracking"],"source":"security@mozilla.org"},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html","tags":["Mailing List"],"source":"security@mozilla.org"},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html","tags":["Mailing List"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-21/","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-22/","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-23/","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://seclists.org/fulldisclosure/2024/Aug/30","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645","tags":["Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/gogs/gogs/issues/7928","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/mozilla/pdf.js/releases/tag/v4.2.67","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/52273","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-21/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-22/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-23/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-827383.html","source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-4367","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}