PDF.js CVE-2024-4367
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF with font object bypassing type check
-
DeliveryDeliver via email attachment or web link
-
ExploitVictim opens or previews PDF in vulnerable PDF.js
-
ExecutionFont handler invokes attacker-controlled function
-
PersistArbitrary JavaScript executes in PDF.js context
-
ImpactExfiltrate data or pivot within browser/mail client origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Victim must open or render an attacker-supplied PDF in a vulnerable PDF.js instance - Firefox <126, Firefox ESR <115.11, Thunderbird <115.11, or a third-party application bundling the unpatched library such as Open-Xchange AppSuite Frontend 7.10.6 revisions 10-13. No authentication is required (PR:N), but user interaction is required (UI:R) in the form of opening the document or allowing inline preview; the default-enabled PDF.js viewer in Firefox/Thunderbird satisfies the configuration prerequisite, while environments that have disabled the built-in PDF viewer or substituted an alternate renderer are not exposed via this path. |
| Impact | Signals converge on this being a real priority: CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) reflects network-reachable, low-complexity, unauthenticated exploitation gated only by the victim opening or previewing a PDF; EPSS at 34.61% (97th percentile) is unusually high and consistent with publicly available exploit code; and the high CIA impact stems from script execution in a privileged renderer context. The vulnerability is not currently listed in CISA KEV based on the provided data, so widespread mass exploitation against U.S. federal agencies has not been confirmed, but the combination of a working public PoC, ubiquity of PDF.js (Firefox, Thunderbird, Debian packages, and third-party integrations like Open-Xchange AppSuite), and user-interaction trigger via routine document handling makes opportunistic and targeted abuse highly plausible. UI:R is the main limiting factor - exploitation requires the user to render an attacker-controlled PDF - but in email and web contexts this is a low bar. |
| Exploit ScenarioDerived | An attacker hosts or emails a malicious PDF crafted to trigger the missing type check during font handling; when the victim opens or previews the file in Firefox, Thunderbird, or any application embedding vulnerable PDF.js, attacker-controlled JavaScript executes in the PDF.js context. Publicly available exploit code exists, lowering the skill barrier and enabling phishing campaigns to weaponize the bug for data theft, session hijacking, or pivoting against integrated web applications such as Open-Xchange AppSuite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Arbitrary JavaScript execution in Mozilla's PDF.js library affects Firefox before 126, Firefox ESR before 115.11, and Thunderbird before 115.11 when rendering a malicious PDF document. A missing type check in font handling lets a crafted PDF run JavaScript in the PDF.js context, and publicly available exploit code exists with an EPSS of 34.61% (97th percentile) indicating elevated exploitation likelihood.
RemediationAI
Vendor-released patches are available: upgrade to Firefox 126 or later, Firefox ESR 115.11 or later, and Thunderbird 115.11 or later per Mozilla's advisories (mozilla.org/security/advisories/mfsa2024-21, mfsa2024-25, mfsa2024-26). Debian users should apply the corresponding DSA-package updates, and Open-Xchange AppSuite Frontend operators should upgrade beyond 7.10.6 revision13 using the Open-Xchange security advisory. Where immediate patching is infeasible, mitigate by disabling the in-browser PDF viewer (set pdfjs.disabled=true in about:config for Firefox, or configure mail clients to not auto-render PDF attachments) and routing PDFs to an external sandboxed viewer - the trade-off is loss of inline preview convenience and possible workflow disruption for users who rely on the embedded viewer.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PDF.js is Mozilla's JavaScript-based PDF rendering engine embedded in Firefox, Thunderbird, and numerous downstream applications such as Open-Xchange AppSuite Frontend that bundle the library for inline document preview. The root cause aligns with CWE-754 (Improper Check for Unusual or Exceptional Conditions): the font-handling code path failed to validate an object's type before treating it as a callable, allowing an attacker-supplied function to be invoked during font processing. Because PDF.js runs as privileged JavaScript inside the browser/mail-client context, this primitive translates into script execution with access to the same origin and APIs as the PDF.js viewer page.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Executive ViewAI
Firefox, Firefox ESR, and Thunderbird browsers are vulnerable to arbitrary JavaScript execution when users open crafted PDF documents, enabling attackers to potentially steal credentials, access sensitive data, or compromise systems. With publicly available exploit code and elevated exploitation probability (EPSS 34.61%), the widespread deployment of these applications creates substantial organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for