CVE-2024-3864

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Apr 16, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-386405.4A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authentCVE-2024-386417.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-386427.8An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local netwCVE-2024-386439.8A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability coCVE-2024-386448.8An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenCVE-2024-386456.5A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow CVE-2024-386466.0An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerCVE-2024-386477.5An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remCVE-2024-386485.7A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uCVE-2024-386497.5An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated atCVE-2024-38658.1Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort soCVE-2024-386509.9An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.
CVE-2024-3864: High severity, CVSS 8.1 | Vulnix