CVE-2024-4770

What it actually does

Use-after-free condition triggered during PDF export when processing certain font styles, allowing memory corruption that can lead to arbitrary code execution.

Why it matters to the business

Attackers could gain full control of a user's browser or email client after the user saves a specially crafted page as PDF, risking data theft or malware deployment; the issue affects widely used open-source builds with no ransomware or KEV activity reported.

How an attack unfolds

An attacker prepares a web page or email containing fonts that exercise the vulnerable PDF-saving code path; when the victim saves the content to PDF the use-after-free is triggered and the attacker-supplied memory contents are executed.

How to fix it

Upgrade to Firefox 126+, Firefox ESR 115.11+ or Thunderbird 115.11+; for zimbra/zm-build rebuild from commit ac6081fa002b1511e926aba37740d2b6c20f3f43 or later.

How to confirm the fix worked

Confirm installed version meets or exceeds the fixed releases listed above; re-test PDF export on pages using the previously crashing font styles.

Typical attack path

1. Deliver malicious page or message to target
2. Victim opens content in vulnerable Firefox, ESR or Thunderbird
3. Victim initiates Save as PDF
4. Font-style processing triggers use-after-free
5. Attacker gains code execution in the browser process

How to detect it

Review browser crash reports for PDF-export paths involving font handling; correlate with web-request logs showing delivery of pages that users later attempted to save as PDF.

What your security team should do

• Prioritize patching all Firefox, ESR and Thunderbird instances within the next 48 hours
• Update zimbra/zm-build packages to the cited commit in CI and production builds
• Monitor for unusual crashes during PDF export in endpoint telemetry
• Block or warn on untrusted web content that users are likely to save as PDF