CVE-2024-4367

What it actually does

The flaw is a missing type validation check in PDF.js font handling. A malicious PDF can place JavaScript-bearing values where numeric font metadata is expected, causing PDF.js to generate and execute attacker-controlled JavaScript while rendering the document. Exploitation requires a user to open or preview the crafted PDF in a vulnerable PDF.js-based viewer, including affected Firefox, Firefox ESR, Thunderbird, or applications embedding vulnerable mozilla/pdf.js. Successful exploitation can compromise confidentiality and integrity within the PDF.js execution context, which may include access to document content, viewer state, same-origin application data depending on deployment, and the ability to make network requests from that context.

Why it matters to the business

Organizations using vulnerable PDF.js-based viewers face a high-risk document-borne attack vector: an attacker can send or host a PDF that runs code when opened. This can lead to theft of data visible to the PDF viewer, unauthorized actions inside web applications that embed PDF.js, phishing or session abuse, and potential follow-on compromise if chained with other browser or application weaknesses. The issue is older, publicly exploitable, and has a high EPSS score, so unpatched deployments should be treated as likely exposed even though it is not listed in CISA KEV and is not specifically marked as ransomware-associated.

How an attack unfolds

An attacker crafts a PDF with malformed font metadata, commonly by abusing the PDF font FontMatrix structure so that non-numeric values containing JavaScript are processed during glyph rendering. The attacker then delivers the file through email, file-sharing, a hosted web link, or any workflow where users preview PDFs. When the victim opens the PDF in a vulnerable Firefox, Firefox ESR, Thunderbird, or web application embedding vulnerable PDF.js, the viewer parses the font data and reaches the vulnerable code path. Because the type check is missing, attacker-controlled content is incorporated into dynamically generated JavaScript used by the PDF renderer. That script executes in the PDF.js context, allowing the attacker to interact with data and capabilities available to that viewer context and potentially exfiltrate information or perform unauthorized in-application actions.

How to fix it

Upgrade all affected PDF.js consumers. For upstream mozilla/pdf.js from Git, use a version containing commit 49b388101a53f1ff81390fab8336d02acf06a582 or later. For Mozilla products, upgrade Firefox to 126 or later, Firefox ESR to 115.11 or later, and Thunderbird to 115.11 or later. For applications that embed PDF.js, update the bundled library and rebuild/redeploy the application rather than relying only on browser updates. If immediate patching is not possible, reduce exposure by disabling PDF preview for untrusted documents, forcing download/opening in a patched external viewer, blocking PDF rendering in vulnerable embedded viewers, restricting who can upload PDFs, and applying content security controls that limit outbound connections from PDF viewer contexts.

How to confirm the fix worked

Confirm deployed browser and mail client versions are Firefox 126 or later, Firefox ESR 115.11 or later, and Thunderbird 115.11 or later. For embedded PDF.js, inspect the bundled dependency, build artifacts, or source lockfiles to verify the code includes commit 49b388101a53f1ff81390fab8336d02acf06a582 or a later fixed release. Test representative applications by opening a benign proof-of-concept PDF in a non-production environment and confirming that embedded JavaScript in malformed font metadata does not execute. Review web application static assets to ensure old pdf.js, pdf.worker.js, and pdf_viewer.js files are not still served from caches, CDNs, or legacy paths after remediation.

Typical attack path

1. Identify an organization or application where users open PDFs in Firefox, Thunderbird, or an embedded PDF.js viewer.
2. Create a malicious PDF with crafted font data, especially a FontMatrix value containing JavaScript-like payload content instead of only numeric values.
3. Deliver the PDF through phishing, a document portal, file upload, collaboration tooling, or a web link.
4. Wait for a victim to open or preview the document in a vulnerable PDF.js-based renderer.
5. Trigger PDF.js font rendering so the malformed font metadata is processed.
6. Execute attacker-controlled JavaScript in the PDF.js context.
7. Use the available context to read accessible document/viewer data, make outbound network requests, steal tokens or page data where exposed, or stage additional attacks.

How to detect it

To determine whether exploitation already occurred, search email gateways, web proxies, file upload repositories, endpoint file telemetry, and document-management logs for PDFs received or opened before patching that contain suspicious font definitions. Prioritize PDFs with /FontMatrix entries containing strings, parentheses, semicolons, JavaScript keywords, network calls, or encoded payloads, because legitimate FontMatrix values should be numeric. Review browser history, download records, cache entries, EDR telemetry, and proxy logs for users who opened suspicious PDFs, then correlate with outbound network requests from Firefox, Thunderbird, or browsers viewing affected applications immediately after PDF rendering. In web applications embedding PDF.js, review access logs for PDF viewer routes followed by unusual same-origin API calls or unexpected outbound requests to unfamiliar domains. On endpoints, investigate suspicious child processes, credential access, or browser data access after PDF viewing, while noting that this vulnerability itself executes JavaScript in the viewer context and may not create a native process unless chained with another exploit. Retain and scan suspect PDFs with YARA or static parsing rules that flag non-numeric FontMatrix arrays and JavaScript-like content in font objects.

• /FontMatrix [
• /FontMatrix[
• /FontMatrix [1 0 0 1 0 (
• /FontMatrix [0.1 0 0 0.1 0 (
• /FontMatrix [1 2 3 4 5 (
• /FontMatrix [1 0 0 1 0 0];
• /FontMatrix
• FontMatrix
• getPathGenerator
• CompiledFont
• new Function
• document.cookie
• XMLHttpRequest(
• fetch(
• navigator.sendBeacon
• import(
• eval(
• Function(
• atob(
• fromCharCode
• app.alert
• /JavaScript
• /OpenAction

What your security team should do

• Inventory all uses of PDF.js, including bundled copies in web applications, document-management systems, portals, helpdesk platforms, and static assets served from CDNs.
• Prioritize patching internet-facing or user-facing PDF preview functionality because exploitation is public, user-assisted, low-complexity, and has a high EPSS score.
• Upgrade Mozilla clients and embedded PDF.js components to fixed versions; verify old pdf.js assets are removed from web roots and caches.
• Temporarily disable preview of untrusted PDFs or route them to a patched rendering service until all embedded viewers are updated.
• Hunt for suspicious PDFs containing malformed FontMatrix values and JavaScript-like strings in email, proxy, file upload, and endpoint telemetry.
• Add detections for PDF downloads or uploads followed by unusual outbound requests from browser processes or from web application origins hosting PDF viewers.
• Educate users and support teams that PDF files can be active attack content and should be handled with the same caution as office documents with macros.