CVE-2024-3859

What it actually does

Integer overflows on 32-bit platforms result in out-of-bounds memory reads when a malformed OpenType font is processed.

Why it matters to the business

Potential exposure of sensitive memory contents in browser or email clients could lead to information disclosure or further compromise in environments still running 32-bit versions of affected software.

How an attack unfolds

An attacker crafts a malicious OpenType font file and delivers it via a web page or email attachment; when the vulnerable 32-bit application parses the font, the integer overflow triggers an out-of-bounds read that may leak memory.

How to fix it

Upgrade Firefox to version 125 or later, Firefox ESR to 115.10 or later, and Thunderbird to 115.10 or later. Disable 32-bit builds where possible and remove support for untrusted fonts.

How to confirm the fix worked

Verify installed product versions meet or exceed the fixed releases listed above; confirm 32-bit builds are no longer in use or are patched; test with known malformed font samples in a lab environment.

Typical attack path

1. Prepare a malformed OpenType font that triggers the integer overflow on 32-bit builds
2. Host or embed the font in a web page or email message
3. Victim opens the content in an affected 32-bit Firefox, ESR, or Thunderbird build
4. Font parser performs out-of-bounds read, potentially disclosing memory contents

How to detect it

Review browser and Thunderbird process crash logs for font-related memory errors; inspect web proxy and email logs for delivery of OpenType font files from untrusted sources; correlate with known malformed font signatures if available.

What your security team should do

• Prioritize patching all 32-bit Firefox, ESR, and Thunderbird instances within the next maintenance window
• Audit environments for continued use of 32-bit browser or mail clients
• Block delivery of untrusted fonts via email gateways and web proxies where feasible
• Monitor EPSS and exploit maturity for any future increase in risk