CVE-2024-6603 In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Use-After-Free Vulnerabilities Affect Firefox and Thunderbird Two vulnerabilities have been identified affecting Firefox and Thunderbird. CVE-2023-3600, published on July 12, 2023, could lead to a crash during the worker lifecycle for versions below Firefox 115.0.2 and Thunderbird 115.0.1. CVE-2024-4770, published on May 14, 2024, involves a potential use-after-free crash when saving pages to PDF for versions below Firefox 126 and Thunderbird 115.11. 7 sources 48

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (2)

Firefox Thunderbird