CVE-2024-2605

What it actually does

An attacker can abuse the Windows Error Reporter to escape the browser sandbox and execute arbitrary code on affected Windows systems.

Why it matters to the business

Enables potential full system compromise for Windows users of vulnerable browsers or related packages; low EPSS with no KEV listing or ransomware use indicates limited active threat but still requires patching on affected AlmaLinux systems where cockpit-session-recording is present.

How an attack unfolds

An attacker crafts content that triggers the Windows Error Reporter within the sandboxed browser process, then leverages the reporter to break out and run arbitrary code outside the sandbox on Windows.

How to fix it

Upgrade Firefox to 124 or later, Firefox ESR to 115.9 or later, Thunderbird to 115.9 or later, and cockpit-session-recording (AlmaLinux:8) to 11-2.el8 or later.

How to confirm the fix worked

Confirm browser and package versions meet or exceed the fixed releases; test that sandbox escape vectors no longer succeed on Windows.

Typical attack path

1. Serve malicious content to a Windows user running an affected browser version
2. Trigger an error condition that invokes the Windows Error Reporter inside the sandbox
3. Exploit the reporter to escape the sandbox and execute attacker-controlled code

How to detect it

Review browser process crash and error reporter logs on Windows endpoints for unexpected sandbox violations or code execution outside expected browser contexts.

What your security team should do

• Prioritize updating all listed affected products to the specified fixed versions
• Monitor EPSS trend for any increase despite current stability
• Apply Windows-specific mitigations if immediate patching is delayed