CVE-2024-11704

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7.

• CWE-415

• https://bugzilla.mozilla.org/show_bug.cgi?id=1899402Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2024-63/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-67/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-09/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-10/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
• https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html

Published

Nov 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11699Memory safety bugs present in Firefox 132, Firefox ESR 128.4…8.8
• CVE-2024-1170The Post Form – Registration Form – Profile Form for User Pr…8.2
• CVE-2024-11700Malicious websites may have been able to perform user intent…8.1
• CVE-2024-11701The incorrect domain may have been displayed in the address …4.3
• CVE-2024-11702Copying sensitive information from Private Browsing tabs on …7.5
• CVE-2024-11703On Android, Firefox may have inadvertently allowed viewing s…5.7
• CVE-2024-11705`NSC_DeriveKey` inadvertently assumed that the `phKey` param…9.1
• CVE-2024-11706A null pointer dereference may have inadvertently occurred i…6.5
• CVE-2024-11707The My auctions allegro plugin for WordPress is vulnerable t…6.1
• CVE-2024-11708Missing thread synchronization primitives could have led to …6.5
• CVE-2024-11709The AI Post Generator | AutoWriter plugin for WordPress is v…4.3
• CVE-2024-1171The Essential Addons for Elementor – Best Elementor Template…5.4