{"id":"CVE-2024-4367","published":"2024-05-14T17:21:23Z","modified":"2026-05-12T11:30:41Z","title":"A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js…","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"affectedVersions":[{"vendor":"Mozilla","product":"Firefox","versions":[">= unspecified, < 126"]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[">= unspecified, < 115.11"]},{"vendor":"Mozilla","product":"Thunderbird","versions":[">= unspecified, < 115.11"]}],"description":{"text":"A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.","provenance":"source","from":"CVE.org"},"summary":{"text":"A missing type check when handling fonts in PDF.js, the PDF renderer bundled with Mozilla Firefox, allows arbitrary JavaScript to run in the PDF.js context. An attacker can exploit it over the network with no privileges or user interaction, though the attack is considered high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:08Z"},"cvss":{"score":5.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.7066,"percentile":0.99391,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"LevelBlue - Open Threat Exchange","url":"https://otx.alienvault.com/pulse/69eb254f17eb4a2a990f07e5","created":"2026-04-24"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-754","name":"Improper Check for Unusual or Exceptional Conditions"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-21/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-22/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-23/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html","tags":[]},{"url":"http://seclists.org/fulldisclosure/2024/Aug/30","tags":[]},{"url":"https://github.com/mozilla/pdf.js/releases/tag/v4.2.67","tags":[]},{"url":"https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/","tags":[]},{"url":"https://github.com/gogs/gogs/issues/7928","tags":[]},{"url":"https://www.exploit-db.com/exploits/52273","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-827383.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"pdfjs-dist","vulnerableRanges":["<4.2.67"],"patched":["4.2.67"],"from":["GHSA-wgrm-67xf-hhpq"],"provenance":"source"}],"advisories":[{"id":"GHSA-wgrm-67xf-hhpq","url":"https://github.com/advisories/GHSA-wgrm-67xf-hhpq","severity":"HIGH","ecosystem":"npm","package":"pdfjs-dist","vulnerableRanges":["<4.2.67"],"patched":["4.2.67"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-1831","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1831","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52273,"url":"https://www.exploit-db.com/exploits/52273","title":"Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution","type":"remote","platform":"multiple","date":"2025-04-22","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-22"},"pocGithub":{"count":23,"skipped":6,"earliest":"2024-05-20","earliestUrl":"https://github.com/LOURC0D3/CVE-2024-4367-PoC","repos":[{"name":"LOURC0D3/CVE-2024-4367-PoC","url":"https://github.com/LOURC0D3/CVE-2024-4367-PoC","stars":203,"created":"2024-05-20"},{"name":"s4vvysec/CVE-2024-4367-POC","url":"https://github.com/s4vvysec/CVE-2024-4367-POC","stars":58,"created":"2024-05-20"},{"name":"Zombie-Kaiser/cve-2024-4367-PoC-fixed","url":"https://github.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed","stars":12,"created":"2024-06-13"},{"name":"spaceraccoon/detect-cve-2024-4367","url":"https://github.com/spaceraccoon/detect-cve-2024-4367","stars":11,"created":"2024-05-22"},{"name":"snyk-labs/pdfjs-vuln-demo","url":"https://github.com/snyk-labs/pdfjs-vuln-demo","stars":10,"created":"2024-06-17"}]},"first":{"date":"2024-05-20","source":"PoC-in-GitHub","url":"https://github.com/LOURC0D3/CVE-2024-4367-PoC"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/52273"],"flow":[],"timeline":[{"date":"2024-05-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-4367","provenance":"source"},{"date":"2024-05-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-04-22","url":"https://github.com/LOURC0D3/CVE-2024-4367-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9939"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 23 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":3.92,"detail":"base score 5.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-wojtekmaj-react-pdf-cve-2024-34342","parents":[{"from":"CVE-2024-34342","to":"CVE-2024-4367","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wgrm-67xf-hhpq","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-87hq-q4gp-9wr4","via":"reference","url":"https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq"}]}],"children":[{"from":"CVE-2024-4367","to":"CVE-2025-59788","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.","from":"CVE.org","in":"CVE-2025-59788"}]}]}}