CVE-2024-6609

What it actually does

Double-free of an elliptic curve key object that was never allocated, triggered under near out-of-memory conditions, resulting in memory corruption.

Why it matters to the business

Attackers may crash the browser or email client or achieve arbitrary code execution on affected systems, potentially leading to data theft or malware deployment; the low and stable exploit probability reduces immediate enterprise risk but still requires prompt patching of widely deployed client software.

How an attack unfolds

An attacker crafts a web page or email that forces the browser or Thunderbird into an out-of-memory state while performing elliptic-curve operations; the resulting double-free corrupts heap metadata and can be turned into a use-after-free primitive for code execution.

How to fix it

Upgrade Firefox and Thunderbird to version 128 or later; enable automatic updates where possible and verify the installed version after patching.

How to confirm the fix worked

Confirm the client version is 128 or higher; test that the application remains stable under simulated memory pressure while exercising cryptographic operations.

Typical attack path

1. Serve malicious content via a web page or email attachment
2. Trigger repeated allocations to approach memory exhaustion
3. Force elliptic-curve key generation or use during the low-memory window
4. Trigger the double-free and corrupt heap structures
5. Achieve control-flow hijacking or information disclosure

How to detect it

Review application crash logs for heap-related faults during cryptographic operations; correlate with web or email content that triggers heavy memory use; no public exploit artifacts are currently known.

What your security team should do

• Apply the version 128 update to all Firefox and Thunderbird installations within the next patch cycle
• Monitor EPSS and KEV feeds for any future rise in exploit activity
• Educate users to keep browsers updated and avoid untrusted content when memory is constrained