CVE-2024-4367
HIGH 8.8EPSS 70.7%
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 5.6 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 70.66% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2024-05-14
- Updated
- 2026-05-12
Proof-of-concept exploits (27)
- 0xr2r/CVE-2024-43670★ · 2025-08-22
- 1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf2★ · 2025-08-25
- Bhavyakcwestern/Hacking-pdf.js-vulnerability0★ · 2025-06-28
- LOURC0D3/CVE-2024-4367-PoC202★ · 2024-06-07
- PenguinCabinet/CVE-2024-4367-hands-on0★ · 2025-05-22
- Scivous/CVE-2024-4367-npm0★ · 2024-06-21
- UnHackerEnCapital/PDFernetRemotelo6★ · 2024-06-20
- VVeakee/CVE-2024-43670★ · 2025-04-06
- Zombie-Kaiser/cve-2024-4367-PoC-fixed12★ · 2024-06-13
- ahmad-kabiri/CVE-2024-4367-PoC1★ · 2025-02-17
- clarkio/pdfjs-vuln-demo4★ · 2024-11-10
- elamani-drawing/CVE-2024-4367-POC-PDFJS1★ · 2025-03-27
- exfil0/WEAPONIZING-CVE-2024-43673★ · 2025-01-05
- inpentest/CVE-2024-4367-PoC1★ · 2025-02-17
- kabiri-labs/CVE-2024-4367-PoC1★ · 2025-02-17
- pS3ud0RAnD0m/cve-2024-4367-poc1★ · 2025-06-28
- pedrochalegre7/CVE-2024-4367-pdf-sample0★ · 2024-11-07
- rzte/pdf-exploit247★ · 2024-07-19
- s4vvysec/CVE-2024-4367-POC57★ · 2024-05-20
- snyk-labs/pdfjs-vuln-demo10★ · 2026-08-04
- AnomalousVectors/cve-2024-4367-poc
- J1nKsC/CVE-2024-4367_test
- veronimo669/pdf.js-CVE-2024-4367
- yuimamur/CVE-2024-4367-hands-on-01
- Nishab-Khatiwada/cve_2024_4367_poc.pdf
- ds-ac-poc/pt-esign__pdfjs-vuln-demo
- luigigubello/bsides-2025