CVE-2024-6603

What it actually does

Out-of-memory allocation failure followed by an unconditional free on the uninitialized pointer results in a use-after-free condition that corrupts heap memory.

Why it matters to the business

Attackers may crash the browser or execute arbitrary code on user systems, leading to data theft, session hijacking, or malware deployment that disrupts operations and requires incident response.

How an attack unfolds

An attacker crafts a web page or email that triggers repeated memory pressure until an allocation fails inside a vulnerable code path; the subsequent free corrupts internal structures, allowing the attacker to control freed memory and achieve code execution when the dangling pointer is later dereferenced.

How to fix it

Upgrade Firefox to 128 or later, Firefox ESR to 115.13 or later, and Thunderbird to 115.13 or 128 or later. Apply updates through the built-in updater or package manager and restart all affected applications.

How to confirm the fix worked

Confirm installed versions match or exceed the fixed releases listed above; retest the affected code paths under simulated memory pressure if source-level validation is required.

Typical attack path

1. Deliver malicious content via a web page or email attachment that targets the browser or mail client
2. Induce repeated out-of-memory conditions to hit the vulnerable allocation path
3. Trigger the erroneous free on the failed allocation pointer
4. Reuse the dangling pointer to corrupt heap metadata or inject attacker-controlled data
5. Achieve arbitrary code execution or denial of service

How to detect it

Monitor browser and mail client crash logs for heap corruption signatures, unexpected process terminations under memory pressure, and any post-crash memory dumps that reference the affected allocation routines.

What your security team should do

• Prioritize patching all Firefox and Thunderbird instances to the fixed versions within the next patch cycle
• Enable automatic updates where possible and monitor for any delayed rollout of the 128/115.13 releases
• Review endpoint detection rules for unexpected browser crashes or memory corruption events
• Communicate the update requirement to end users and verify completion via inventory scans