CVE-2024-10467

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787 CWE-120 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-104685.3Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability a CVE-2024-104696.5VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.CVE-2024-10475.3Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing cap CVE-2024-104709.8The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due CVE-2024-104714.8The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-104725.9The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege u CVE-2024-104735.4The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the CVE-2024-104746.5Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circum CVE-2024-104754.8The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings CVE-2024-104768.0Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify CVE-2024-104775.4A vulnerability classified as problematic was found in LinZhaoguan pb-cms up to 2.0.1. This vulnerability affects unknown code of the file /CVE-2024-104785.4A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms up to 2.0.1. This issue affects some unknown proc