CyberSecBulletin
CVE-2024-4778NVD status: Analyzed

Firefox: Improper Handling of Overlap Between Protected Memory Ranges

Published Updated By the CyberSecBulletin desk

CVE-2024-4778 is a critical-severity improper handling of overlap between protected memory ranges vulnerability in Firefox from Mozilla, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 126 as the first without the flaw, so updating Firefox to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.44% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Firefox to 126 or a later version.
  2. Read the advisory on mozilla.org for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
MozillaFirefoxbefore 126126

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Handling of Overlap Between Protected Memory Ranges

The product allows address regions to overlap, which can result in the bypassing of intended memory protection.

How developers prevent this class of flaw

  • Ensure that memory regions are isolated as intended and that access control (read/write) policies are used by hardware to protect privileged software.

More Improper Handling of Overlap Between Protected Memory Ranges vulnerabilities (CWE-1260)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Firefox

All Firefox vulnerabilities

Recent Improper Handling of Overlap Between Protected Memory Ranges vulnerabilities

Spotted an error? Tell us.