CVE-2024-7526
MEDIUMCVSS 6.5/10EPSS 0.55%
Last modified
CVE-2024-7526 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 129.0 |
| Mozilla | Firefox Esr | < 115.14.0 |
| Mozilla | Firefox Esr | 128.0 |
| Mozilla | Thunderbird | < 115.14.0 |
| Mozilla | Thunderbird | 128.0.1 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1910306Issue Tracking, Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2024-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-35/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-37/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-38/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-7526?
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
How severe is CVE-2024-7526?
CVE-2024-7526 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.55% probability of exploitation in the next 30 days.
How do I fix CVE-2024-7526?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-7520A type confusion bug in WebAssembly could be leveraged by an…8.8
- CVE-2024-7521Incomplete WebAssembly exception handing could have led to a…8.8
- CVE-2024-7522Editor code failed to check an attribute value. This could h…8.8
- CVE-2024-7523A select option could partially obscure security prompts. Th…8.1
- CVE-2024-7524Firefox adds web-compatibility shims in place of some tracki…6.1
- CVE-2024-7525It was possible for a web extension with minimal permissions…8.1
- CVE-2024-7527Unexpected marking work at the start of sweeping could have …8.8
- CVE-2024-7528Incorrect garbage collection interaction in IndexedDB could …8.8
- CVE-2024-7529The date picker could partially obscure security prompts. Th…6.5
- CVE-2024-7530Incorrect garbage collection interaction could have led to a…8.8
- CVE-2024-7531Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the s…6.5
- CVE-2024-7532Out of bounds memory access in ANGLE in Google Chrome prior …8.8
Are you affected by CVE-2024-7526?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST