Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9caj-c15z-xuf5
Vulnerability ID VCID-9caj-c15z-xuf5
Aliases CVE-2024-9403
Summary Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9403.json
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
epss 0.00103 https://api.first.org/data/v1/epss?cve=CVE-2024-9403
cvssv3.1 7.3 https://bugzilla.mozilla.org/show_bug.cgi?id=1917807
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1917807
cvssv3.1 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-46
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-50
cvssv3.1 7.3 https://www.mozilla.org/security/advisories/mfsa2024-46/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-46/
cvssv3.1 7.3 https://www.mozilla.org/security/advisories/mfsa2024-50/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-50/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9403.json
https://api.first.org/data/v1/epss?cve=CVE-2024-9403
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2315947 https://bugzilla.redhat.com/show_bug.cgi?id=2315947
GLSA-202412-04 https://security.gentoo.org/glsa/202412-04
GLSA-202412-06 https://security.gentoo.org/glsa/202412-06
GLSA-202505-08 https://security.gentoo.org/glsa/202505-08
mfsa2024-46 https://www.mozilla.org/en-US/security/advisories/mfsa2024-46
mfsa2024-46 https://www.mozilla.org/security/advisories/mfsa2024-46/
mfsa2024-50 https://www.mozilla.org/en-US/security/advisories/mfsa2024-50
mfsa2024-50 https://www.mozilla.org/security/advisories/mfsa2024-50/
RHSA-2024:7552 https://access.redhat.com/errata/RHSA-2024:7552
RHSA-2024:7621 https://access.redhat.com/errata/RHSA-2024:7621
RHSA-2024:7622 https://access.redhat.com/errata/RHSA-2024:7622
RHSA-2024:7646 https://access.redhat.com/errata/RHSA-2024:7646
RHSA-2024:7699 https://access.redhat.com/errata/RHSA-2024:7699
RHSA-2024:7702 https://access.redhat.com/errata/RHSA-2024:7702
RHSA-2024:7703 https://access.redhat.com/errata/RHSA-2024:7703
RHSA-2024:7704 https://access.redhat.com/errata/RHSA-2024:7704
RHSA-2024:7842 https://access.redhat.com/errata/RHSA-2024:7842
RHSA-2024:7853 https://access.redhat.com/errata/RHSA-2024:7853
RHSA-2024:7854 https://access.redhat.com/errata/RHSA-2024:7854
RHSA-2024:7855 https://access.redhat.com/errata/RHSA-2024:7855
RHSA-2024:7856 https://access.redhat.com/errata/RHSA-2024:7856
RHSA-2024:8166 https://access.redhat.com/errata/RHSA-2024:8166
RHSA-2024:8169 https://access.redhat.com/errata/RHSA-2024:8169
show_bug.cgi?id=1917807 https://bugzilla.mozilla.org/show_bug.cgi?id=1917807
USN-7056-1 https://usn.ubuntu.com/7056-1/
USN-7991-1 https://usn.ubuntu.com/7991-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9403.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1917807
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:34:25Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1917807
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-46/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:34:25Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-46/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-50/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:34:25Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-50/
Exploit Prediction Scoring System (EPSS)
Percentile 0.28408
EPSS Score 0.00103
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:01:01.490198+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202412-06 38.0.0