CVE-2024-5696

What it actually does

Manipulating text in an input tag triggers memory corruption that can lead to a crash with potential for further exploitation.

Why it matters to the business

Users of affected browser and email clients face risk of crashes or memory issues that could disrupt operations; low EPSS and no KEV status indicate limited observed exploitation urgency, though high CVSS warrants prompt attention given widespread use of the products.

How an attack unfolds

An attacker crafts malicious text content inside an input tag and delivers it to a victim via web page or email, triggering the memory corruption flaw during parsing.

How to fix it

Upgrade Firefox to version 127 or later, Firefox ESR to 115.12 or later, and Thunderbird to 115.12 or later. For opennds/opennds (GIT) instances, apply the fix from commit 69dde77927b252e2a4347170504a785ac5d50c33.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed above and test that crafted input tags no longer produce crashes.

Typical attack path

1. Identify or host a page/email containing a specially crafted input tag with manipulated text
2. Trick the victim into loading the content in an affected Firefox, ESR, or Thunderbird version
3. Trigger memory corruption on parsing leading to crash or potential code execution

How to detect it

Review browser crash logs and memory dumps for patterns involving input tag parsing; check application version inventories against the vulnerable ranges.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the fixed versions immediately
• Monitor for any new exploit maturity signals given the memory corruption nature
• Apply the opennds GIT commit if that package is in use within the environment