CVE-2024-1552
Mozilla Firefox ≤ 115.8.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-1552 is a high-severity Incorrect Conversion between Numeric Types (CWE-681) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17299
Vulnerability Data
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect numeric conversions through targeted test cases.
Engineering principles can mandate safe numeric handling and range checks that structurally avoid bad conversions.
Input validation directly stops malformed or out-of-range numeric values from reaching conversion logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code reviews, static analysis, and developer training that catch and prevent numeric type-conversion errors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes type-safety and conversion checks that reduce numeric truncation risks.
A.8.26 requires identifying and specifying security requirements (including resilience against certain attacks like buffer overflows or SQL injection) but does not itself implement any conversion checks, bounds validation, or other mechanisms that would stop exploitation of incorrect numeric type conversions
Secure architecture principles promote strong typing and safe conversion practices.
Secure coding standards directly address correct numeric type conversions and overflow checks.
Security testing can detect numeric conversion defects before release.