CVE-2024-11691

HIGH

8.8

CVSS Score

Published: November 26, 2024 at 01:33 PM UTC

Updated: June 17, 2026 at 06:58 AM UTC

3 products affected across 1 vendorFirefoxThunderbirdFirefox ESR· also runs on 15 platforms

Using Firefox by Mozilla?

Get instant alerts when new vulnerabilities affect Firefox - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver. *This bug only affected the application on Apple M series hardware. Other platforms were unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Firefox · Mozilla

95%

v < 115.18.0v < 133116.0 ≤ v < 128.5.0129.0 ≤ v < 133.0

Affected range stops below 115.18.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 128.5.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 133, so it looks safe — our inference, not a vendor statement

Affected range stops below 133.0, so it looks safe — our inference, not a vendor statement

apple-m1 (environment) · apple-m1-max (environment) · apple-m1-pro (environment) · apple-m1-ultra (environment) · apple-m2 (environment) · apple-m2-max (environment) · apple-m2-pro (environment) · apple-m2-ultra (environment) · apple-m3 (environment) · apple-m3-max (environment) · apple-m3-pro (environment) · apple-m3-ultra (environment) · apple-m4 (environment) · apple-m4-max (environment) · apple-m4-pro (environment)

Thunderbird · Mozilla

95%

v < 115.18v < 115.18.0v < 128.5v < 133116.0 ≤ v < 128.5.0129.0 ≤ v < 133.0

Affected range stops below 115.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 115.18.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 128.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 128.5.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 133, so it looks safe — our inference, not a vendor statement

Affected range stops below 133.0, so it looks safe — our inference, not a vendor statement

Firefox ESR · Mozilla

60%

v < 115.18v < 128.5