CVE-2024-11691: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver. *This bug only affected the application on Apple M series hardware. Other platforms were unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.

Affected products

• Mozilla Firefox: before 115.18.0 (fixed in 115.18.0); from 116.0, before 128.5.0 (fixed in 128.5.0); from 129.0, before 133.0 (fixed in 133.0)
• Mozilla Thunderbird: before 115.18.0 (fixed in 115.18.0); from 116.0, before 128.5.0 (fixed in 128.5.0); from 129.0, before 133.0 (fixed in 133.0)

Published 2024-11-26. Last modified 2026-06-17.