CVE-2024-4771

2024-05-1418:15:14

CWE-416

mozilla

web.nvd.nist.gov

firefox

memory allocation

vulnerability

code execution

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

6.3

Confidence

Low

EPSS

Percentile

9.0%

JSON

A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 126.

Affected configurations

Vulners

Vulnrichment

Node

mozillafirefoxRange≤126

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "126",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]