CVE-2024-4367: Code Execution in PDF.js

CVE-2024-4367 is an arbitrary code execution vulnerability in PDF.js (Mozilla's PDF rendering component). A missing type check during font processing enables arbitrary JavaScript execution within the PDF.js context. It affects Firefox <126, Firefox ESR <115.11, and Thunderbird <115.11.

The CVSS score for CVE-2024-4367 is 8.8, classified as HIGH severity. The vulnerability was published by NVD on May 14, 2024. As of November 2, 2026, a public repository has been identified claiming to contain proof-of-concept (PoC) code for this vulnerability, confirming that the flaw has been made available in an actionable form to potential attackers. Corrective patches were released by Mozilla in May 2024 for all affected versions.

For IT administrators and security teams, it is critical to verify and deploy updates for Firefox, Firefox ESR, and Thunderbird to the specified versions (126, 115.11, or later). Given that a public PoC is available, the risk of active exploitation is high. It is recommended to implement an urgent patching strategy, check for suspicious access to PDF files in systems in use, and consider temporarily disabling the viewing of unverified PDFs until patching is complete. Monitor security logs for signs of anomalous code execution related to PDF processing.