Back to KEVs

CVE-2024-4367

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability...

Basic Information

CVE State
PUBLISHED
Reserved Date
April 30, 2024
Published Date
May 14, 2024
Last Updated
May 12, 2026
Vendor
Mozilla
Product
Firefox, Firefox ESR, Thunderbird
Description
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

CVSS Scores

CVSS v3.1

8.8 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
poc
Technical Impact
total

Exploit Status

Proof of Concept Available
Yes (added 2024-09-04 14:43:33 UTC) Source

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645 https://www.mozilla.org/security/advisories/mfsa2024-21/ https://www.mozilla.org/security/advisories/mfsa2024-22/ https://www.mozilla.org/security/advisories/mfsa2024-23/ https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2026-04-15 14:28:37 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

Masamuneee/CVE-2024-4367-Analysis

Type: github • Created: 2024-09-04 14:43:33 UTC • Stars: 2

s4vvysec/CVE-2024-4367-POC

Type: github • Created: 2024-05-20 22:56:10 UTC • Stars: 49

CVE-2024-4367 arbitrary js execution in pdf js

LOURC0D3/CVE-2024-4367-PoC

Type: github • Created: 2024-05-20 10:02:23 UTC • Stars: 161

CVE-2024-4367 & CVE-2024-34342 Proof of Concept

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Added to KEVIntel