CVE-2024-6604

What it actually does

Multiple memory safety issues resulting in memory corruption that could be leveraged for arbitrary code execution.

Why it matters to the business

Potential for remote code execution on user systems running affected browser or email client versions, enabling data theft or malware deployment; low urgency given stable low EPSS and no KEV listing despite 824 days since publication.

How an attack unfolds

An attacker crafts and delivers malicious web content or email to trigger one of the memory safety bugs, causing corruption that with sufficient effort allows arbitrary code to run in the context of the browser or Thunderbird process.

How to fix it

Upgrade Firefox to version 128 or later, Firefox ESR to 115.13 or later, and Thunderbird to 115.13 or later; for onevpl-intel-gpu on Debian 13 update to version 24.3.3-1.

How to confirm the fix worked

Verify installed versions meet or exceed the fixed releases listed; review application update logs and package manager history to confirm deployment of patches.

Typical attack path

1. Deliver malicious webpage or email attachment to victim
2. Trigger memory corruption via crafted input
3. Exploit corruption to execute arbitrary code
4. Establish persistence or exfiltrate data

How to detect it

Examine browser process crash reports and memory dumps for corruption patterns; review web server and email logs for delivery of suspicious content around the time of any anomalous process behavior.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the specified fixed versions
• Monitor EPSS and KEV updates for any change in exploitation likelihood
• Review browser and email client configurations to limit exposure to untrusted content