CVE-2024-8394

What it actually does

Use-after-free triggered when aborting OTR chat session verification, resulting in a potentially exploitable crash.

Why it matters to the business

Disruption to secure messaging workflows in email clients with risk of remote exploitation and system compromise; high ecosystem prevalence increases urgency for organizations relying on the affected software.

How an attack unfolds

An attacker starts an OTR chat session with the victim and then aborts the verification process in a crafted manner that triggers the use-after-free condition to crash the application or achieve code execution.

How to fix it

Upgrade Thunderbird to version 128.2 or later; for go-ethereum environments update to 1.10.17 or newer as applicable.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed release; review changelog for OTR verification handling fixes and test session abort scenarios.

Typical attack path

1. Establish OTR chat session with target
2. Initiate verification process
3. Abort verification using malicious timing or input
4. Trigger use-after-free to crash or exploit memory

How to detect it

Examine application crash logs and memory dumps around OTR session events for signs of use-after-free; correlate with chat session start/abort timestamps.

What your security team should do

• Prioritize patching all instances to the fixed version immediately due to 765 days since publication
• Monitor for any new exploit maturity indicators
• Review OTR chat configurations and disable if not required