CVE-2024-1552

What it actually does

Incorrect code generation on 32-bit ARM devices produces unexpected numeric conversions that trigger undefined behavior and memory corruption.

Why it matters to the business

Organizations running the affected browser or email client on 32-bit ARM hardware face elevated risk of remote code execution, data disclosure, or denial of service when users open malicious content, though prevalence is limited to a narrow device class and exploitation remains uncommon.

How an attack unfolds

An attacker crafts content that triggers the faulty numeric conversion path during execution on a 32-bit ARM device; the resulting undefined behavior is then abused to corrupt memory and achieve arbitrary code execution within the browser or email client process.

How to fix it

Upgrade Firefox to version 123 or later, Firefox ESR to 115.8 or later, and Thunderbird to 115.8 or later; disable or replace 32-bit ARM devices where updates cannot be applied.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed above and test representative 32-bit ARM hardware against known trigger cases or updated builds.

Typical attack path

1. Identify or lure a target using a 32-bit ARM device running an unpatched version
2. Deliver malicious web content or email attachment that exercises the incorrect code generation path
3. Trigger numeric conversion error leading to memory corruption
4. Leverage corruption primitive to bypass protections and execute attacker-controlled code

How to detect it

Review browser and system crash logs on 32-bit ARM devices for unusual numeric or conversion-related faults around the time of suspected exposure; correlate with web or email access logs to malicious domains.

What your security team should do

• Prioritize patching all 32-bit ARM Firefox, ESR, and Thunderbird installations within standard change windows
• Inventory endpoints to identify any remaining 32-bit ARM devices and schedule replacement or isolation
• Monitor EPSS and KEV status for any future increase in exploit activity