CVE-2024-4367
HIGH 8.8EPSS 70.7%
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
- Affected
- Mozilla · Firefox · Firefox ESR · Thunderbird
- CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1 CNA
- 5.6 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - EPSS
- 70.66% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2024-05-14
- Updated
- 2026-05-12
Proof-of-concept exploits (29)
- 0xr2r/CVE-2024-43670★ · 2025-08-22
- 1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf2★ · 2025-08-25
- Bhavyakcwestern/Hacking-pdf.js-vulnerability0★ · 2025-06-28
- LOURC0D3/CVE-2024-4367-PoC203★ · 2024-06-07
- PenguinCabinet/CVE-2024-4367-hands-on0★ · 2025-05-22
- UnHackerEnCapital/PDFernetRemotelo6★ · 2024-06-20
- VVeakee/CVE-2024-43670★ · 2025-04-06
- Zombie-Kaiser/cve-2024-4367-PoC-fixed12★ · 2024-06-13
- ahmad-kabiri/CVE-2024-4367-PoC1★ · 2025-02-17
- clarkio/pdfjs-vuln-demo4★ · 2024-11-10
- elamani-drawing/CVE-2024-4367-POC-PDFJS1★ · 2025-03-27
- exfil0/WEAPONIZING-CVE-2024-43673★ · 2025-01-05
- inpentest/CVE-2024-4367-PoC1★ · 2025-02-17
- kabiri-labs/CVE-2024-4367-PoC1★ · 2025-02-17
- pS3ud0RAnD0m/cve-2024-4367-poc2★ · 2025-06-28
- pedrochalegre7/CVE-2024-4367-pdf-sample0★ · 2024-11-07
- rzte/pdf-exploit247★ · 2024-07-19
- s4vvysec/CVE-2024-4367-POC58★ · 2024-05-20
- snyk-labs/pdfjs-vuln-demo10★ · 2026-10-07
- AnomalousVectors/cve-2024-4367-poc2★ · 2025-06-28
- J1nKsC/CVE-2024-4367_test0★ · 2026-08-13
- veronimo669/pdf.js-CVE-2024-43671★ · 2026-06-25
- yuimamur/CVE-2024-4367-hands-on-010★ · 2026-07-27
- Nishab-Khatiwada/cve_2024_4367_poc.pdf0★ · 2026-05-18
- ds-ac-poc/pt-esign__pdfjs-vuln-demo0★ · 2026-08-10
- luigigubello/bsides-20250★ · 2025-11-09
- yuanoes/zhipin-pdfjs-4367-probe0★ · 2026-09-21
- Eib98/miro-desktop-poc0★ · 2026-09-21
- Masamuneee/CVE-2024-4367-Analysis/blob/19205ccff067cd3f282380974def589f08603dc8/poc/poc.py5★ · 2024-09-04
ExploitDB entries (1)
Vulhub environments (1)
Security advisories
- https://www.mozilla.org/security/advisories/mfsa2024-21
- https://www.mozilla.org/security/advisories/mfsa2024-22
- https://www.mozilla.org/security/advisories/mfsa2024-23
- advisories/GHSA-wgrm-67xf-hhpq
- https://bugzilla.mozilla.org/show_bug.cgi?id=1893645