CVE-2024-4367: exploitation status and patch state
CVE-2024-4367 · CVSS 8.8 HIGH · EPSS 73%
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Is CVE-2024-4367 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 73%.
Public exploit code: proof of concept.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2024-4367
PlainSec has not published a story about this CVE.