CVE-2024-11704

In the `sec_pkcs7_decoder_start_decrypt()` function handling the error path in symmetric encryption, the same symmetric key may be freed from memory twice (double-free). Such double freeing of the same memory area leads to heap corruption. An attacker could potentially exploit this state to take control of program execution by crafting a specially constructed message or content that triggers the incorrect code path.

Successful exploitation of this vulnerability may lead to arbitrary code execution (RCE) in the context of the browser or mail client process, as well as disclosure of sensitive data or destabilization of application functionality.

Firefox should be updated immediately to version 133 or newer (for ESR branch to version 128.7 or newer) and Thunderbird to version 133 or newer (for ESR branch to version 128.7 or newer). Details available in Mozilla security advisories: mfsa2024-63, mfsa2024-67, mfsa2025-09, mfsa2025-10.

Mozilla Firefox versions below 133, Mozilla Firefox ESR versions below 128.7, Mozilla Thunderbird versions below 133, and Mozilla Thunderbird ESR versions below 128.7.