CVE-2024-3861

What it actually does

Self-assignment of an AlignedBuffer triggers an incorrect reference count during a subsequent self-move, resulting in a use-after-free that permits limited memory disclosure.

Why it matters to the business

Local attackers may read portions of browser memory containing sensitive data, creating a modest risk of information exposure on affected systems until updates are applied.

How an attack unfolds

An attacker with the ability to execute code or supply crafted content inside the browser process triggers the self-move assignment on an AlignedBuffer, corrupting its reference count and producing a dangling pointer that is later dereferenced to leak memory contents.

How to fix it

Upgrade Firefox to 125 or newer, Firefox ESR to 115.10 or newer, and Thunderbird to 115.10 or newer.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases and review source or test cases to ensure self-assignment of AlignedBuffer no longer produces reference-count errors.

Typical attack path

1. Gain the ability to run or influence code within the browser process
2. Craft or trigger input that causes an AlignedBuffer to be assigned to itself
3. Force the subsequent self-move operation to produce an incorrect reference count
4. Dereference the resulting dangling pointer to read arbitrary memory

How to detect it

Examine browser crash logs, memory sanitizer reports, and process memory dumps for evidence of dangling pointers or unexpected reference-count decrements during buffer operations.

What your security team should do

• Apply the listed browser updates across all managed endpoints
• Prioritize patching on systems where local code execution risk is elevated
• Review crash reports and memory sanitizer output for signs of buffer handling anomalies