# CVE-2024-4367: Mozilla PDF.js arbitrary JavaScript execution in font handling

Source: https://junglewise.ai/threats/cve-2024-4367-mozilla-pdf-js-arbitrary-javascript-execution-in-font-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-14. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2024-4367 · Severity: high · CVSS 8.8 · Published 2024-05-14

Mozilla PDF.js, a widely used library for displaying PDF files in web browsers, is vulnerable to a flaw that allows a malicious PDF to execute arbitrary code. If a user opens a specially crafted PDF file, an attacker could run malicious scripts in the user's browser, potentially leading to data theft or unauthorized actions on the hosting website. This affects any website or application that uses the default configuration of this library to render PDFs.

Technologies: [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox), [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr), [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla), [npm](https://junglewise.ai/threats/vendors/npm), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2024-4367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-4367 being exploited in the wild.

**How severe is CVE-2024-4367?** High severity, with a CVSS score of 8.8, published 14 May 2024.

**Which products and versions are affected?** Mozilla Firefox < 126; Mozilla Firefox ESR < 115.11; Mozilla PDF.js < 4.2.67; Mozilla Thunderbird < 115.11; and 2 more.

**Is there a fix for CVE-2024-4367?** Yes. pdfjs-dist (npm): upgrade to 4.2.67 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-4367 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-4367?** Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla PDF.js or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pdfjs-dist (npm): upgrade to 4.2.67 or later

  ```sh
  npm install pdfjs-dist@4.2.67
  ```


## Technical details

A vulnerability in Mozilla PDF.js (specifically the pdfjs-dist npm package) allows for arbitrary JavaScript execution in the context of the hosting domain. The issue stems from the library's use of 'eval' when processing PDF content, which can be abused by a specially crafted PDF file to execute attacker-controlled scripts. This occurs when the 'isEvalSupported' configuration option is set to true, which is the default behavior. An attacker can achieve full Cross-Site Scripting (XSS) by enticing a user to open a malicious PDF. The vulnerability is patched in version 4.2.67 by removing the reliance on 'eval'.

## Affected products

- Mozilla pdfjs-dist <= 4.1.392

## Identifiers

- CVE-2024-4367
- GHSA-wgrm-67xf-hhpq

## Timeline

- 2024-05-06: disclosed
- 2024-05-07: advisory: GitHub Advisory published
- 2024-05-14: patched: NVD publication and patch availability confirmed

## References

- [https://api.github.com/users/ThomasRinsma](https://api.github.com/users/ThomasRinsma)
- [https://github.com/ThomasRinsma](https://github.com/ThomasRinsma)
- [https://api.github.com/users/ThomasRinsma/gists%7B/gist_id%7D](https://api.github.com/users/ThomasRinsma/gists%7B/gist_id%7D)
- [https://api.github.com/users/ThomasRinsma/repos](https://api.github.com/users/ThomasRinsma/repos)
- [https://avatars.githubusercontent.com/u/3109710?v=4](https://avatars.githubusercontent.com/u/3109710?v=4)
- [https://api.github.com/users/ThomasRinsma/events%7B/privacy%7D](https://api.github.com/users/ThomasRinsma/events%7B/privacy%7D)

## Related threats

- [Thunderbird OAuth2 access token leak over HTTP with Exchange accounts](https://junglewise.ai/threats/cve-2026-126136-for-exchange-accounts-using-ews-or-microsoft-graph-with-oauth2)
- [Mozilla Thunderbird SMTP/POP3 response injection via STARTTLS](https://junglewise.ai/threats/cve-2026-126135-if-an-attacker-was-able-to-perform-a-man-in-the-middle-attack-on)
- [Thunderbird NTLM credential leak via feed subscription to file URL](https://junglewise.ai/threats/cve-2026-126134-thunderbird-allowed-feed-subscriptions-to-file-urls-that-point)
- [Thunderbird calendar server credentials sent to HTTP proxy](https://junglewise.ai/threats/cve-2026-126133-when-a-caldav-or-ics-calendar-was-accessed-through-an-http-proxy)
- [Thunderbird attachment replacement disclosure via link files](https://junglewise.ai/threats/cve-2026-126132-when-a-message-was-forwarded-inline-edited-as-new-or-had-an)