{"id":"CVE-2024-9680","kind":"vulnerability","aliases":["CVE-2024-9680"],"related":[],"title":"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation…","description":"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.","summary":"Firefox and Firefox ESR have a use-after-free bug in animation timelines that lets a crafted web page run code inside the content process. CISA lists it as actively exploited in the wild, and the KEV entry notes ransomware use.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-10-15T00:00:00+00:00","products":[{"name":"mozilla firefox","fixed":["115.16.1"],"affected":"< 115.16.1","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["131.0.2"],"affected":"< 131.0.2","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["128.3.1"],"affected":">= 128.1.0, < 128.3.1","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":["115.16.0"],"affected":"< 115.16.0","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":["128.3.1"],"affected":">= 128.0.1, < 128.3.1","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":[],"affected":"= 131.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"Mozilla Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","desktop","exploited","firefox","firefox-esr","ransomware","runtime"],"not_affected_if":["unknown"],"how_to_check":"Check the Firefox version under Help > About Firefox and compare it with the fixed release in the Mozilla advisory; the sources do not name a fixed version.","fix":"Update Firefox and Firefox ESR to the latest release; the sources do not name the fixed version.\nIf an update is not possible, follow the vendor mitigations or stop using the product, as CISA requires.","status":"open","published_at":"2024-10-09T13:15:12+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:26+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T20:56:26Z","model":"claude-haiku-5-5","output":{"fix":"Update Firefox and Firefox ESR to the latest release; the sources do not name the fixed version.\nIf an update is not possible, follow the vendor mitigations or stop using the product, as CISA requires.","reach":"internet","impact":"high","summary":"Firefox and Firefox ESR have a use-after-free bug in animation timelines that lets a crafted web page run code inside the content process. CISA lists it as actively exploited in the wild, and the KEV entry notes ransomware use.","category":"runtime","who_cares":["firefox","firefox-esr","desktop","browser"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code inside the browser's content process via a malicious web page.","analyst_note":"Find the Mozilla advisory for CVE-2024-9680 to get the fixed Firefox and ESR versions and any mitigation steps.","how_to_check":"Check the Firefox version under Help > About Firefox and compare it with the fixed release in the Mozilla advisory; the sources do not name a fixed version.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2815,"output_tokens":426,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':23A,26A '-9680':24A,27A '115.16.0':146C '115.16.1':139C '128.3.1':136C,143C '131.0.1':141C '131.0.2':133C 'abl':4A,98C 'achiev':6A,100C 'activ':83B 'affect':131C 'anim':21A,65B,115C 'attack':2A,96C 'browser':44B 'bug':63B 'cisa':79B 'code':7A,74B,101C 'content':11A,77B,105C 'craft':70B 'cve':22A,25A 'debian':40A 'desktop':45B 'entri':91B 'esr':50B,56B,135C,138C 'execut':8A,102C 'exploit':14A,46B,84B,108C,125C 'firefox':29A,31A,33A,43A,47B,49B,53B,55B,132C,134C,137C 'firefox-esr':48B 'free':19A,62B,113C 'insid':75B 'kev':90B 'let':68B 'linux':41A 'list':80B 'mozilla':28A,30A,32A,34A,36A,38A,42A 'note':92B 'page':72B 'process':12A,78B,106C 'ransomwar':51B,93B 'report':120C 'run':73B 'runtim':52B 'thunderbird':35A,37A,39A,140C,142C,145C 'timelin':66B,116C 'use':17A,60B,94B,111C 'use-after-fre':16A,59B,110C 'vulner':123C,130C 'web':71B 'wild':87B,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-09T13:15:12+00:00","kev":{"dateAdded":"2024-10-15","dueDate":"2024-11-05","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-9680","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9680","severity":null,"published_at":"2024-10-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-9680","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9680","severity":null,"published_at":"2024-10-09T13:15:12+00:00","modified_at":"2026-08-04T05:16:32+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}