Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2024-5700 is a high-severity Access of Memory Location Before Start of Buffer (CWE-786) vulnerability in Mozilla Firefox. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46872
Vulnerability Data
Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…
more
This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static/dynamic analysis can discover buffer-underflow conditions before deployment.
Security engineering principles require use of memory-safe constructs, bounds checking, and avoidance of pointer arithmetic that can produce underflow accesses.
Input validation rejects or sanitizes untrusted indices or offsets before they are used to compute buffer pointers.
Memory-protection controls limit the effects of an out-of-bounds read/write even if the erroneous access occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent buffer underflows via safe coding, bounds checks, and analysis, but eliminating only this CWE covers a narrow slice of the control's broader intent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and eliminate pre-buffer memory accesses before release.
Secure development lifecycle includes buffer-boundary checks that reduce out-of-bounds reads before buffer start.
Application security requirements can mandate bounds checking and pointer validation to prevent pre-buffer accesses.
Secure architecture principles promote safe memory handling and pointer arithmetic safeguards.
Secure coding standards directly require bounds checking and pointer validation that prevent this weakness.