CVE-2024-2612

What it actually does

A specially crafted code path in SafeRefPtr triggers memory corruption that can result in a crash or arbitrary code execution.

Why it matters to the business

Attackers could remotely crash the application or execute code on affected systems, leading to service disruption, data theft, or full host compromise; the issue affects widely deployed browser and mail clients with no known active exploitation or ransomware use.

How an attack unfolds

An attacker crafts input or a web page that reaches the vulnerable SafeRefPtr code path, corrupts memory, and leverages the corruption to achieve code execution or denial of service.

How to fix it

Upgrade Firefox to version 124 or later, Firefox ESR to 115.9 or later, and Thunderbird to 115.9 or later. No other mitigations are required once updated.

How to confirm the fix worked

Confirm the installed browser or mail client version meets or exceeds the fixed releases listed in the advisory; re-test the application with known triggering inputs if available in a lab environment.

Typical attack path

1. Deliver malicious content via network to a vulnerable Firefox, ESR, or Thunderbird instance
2. Trigger the specific SafeRefPtr code path through crafted data or page
3. Exploit resulting memory corruption to execute attacker-controlled code or crash the process

How to detect it

Review browser process crash logs and memory dumps for SafeRefPtr-related faults; correlate with web request logs showing unusual content that reaches the vulnerable code path.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances within standard change windows
• Monitor EPSS and KEV status for any future increase in exploit activity
• Block unneeded browser plugins or extensions that could increase attack surface