CVE-2026-4695 Mozilla CVE debrief

Who should care

Organizations and individuals using Mozilla Firefox, Firefox ESR, Thunderbird, or Thunderbird should prioritize patching this vulnerability. The HIGH severity rating and CVSS score of 7.5 indicate that this vulnerability could have significant impacts if exploited. Users of affected products should update to the latest versions to mitigate potential risks.

Technical summary

The CVE-2026-4695 vulnerability is related to incorrect boundary conditions in the Audio/Video: Web Codecs component. This issue could potentially allow attackers to exploit the vulnerability remotely. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that the vulnerability can be exploited over the network with low attack complexity and no privileges required. The weaknesses associated with this vulnerability include CWE-754 and CWE-131.

Defensive priority

Patching is the primary recommended action for CVE-2026-4695. Organizations should prioritize updating Firefox to version 149 or later, Firefox ESR to version 140.9 or later, Thunderbird to version 149 or later, and Thunderbird to version 140.9 or later. Additionally, defenders should consider monitoring for potential exploitation attempts and ensuring that compensating controls are in place if immediate patching is not feasible.

Recommended defensive actions

• Patch Firefox to version 149 or later
• Patch Firefox ESR to version 140.9 or later
• Patch Thunderbird to version 149 or later
• Patch Thunderbird to version 140.9 or later
• Monitor for potential exploitation attempts
• Review and update inventory of affected products

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Multiple vendor advisories and references are available, including those from Mozilla and Red Hat. The CVE record was last modified on June 30, 2026, indicating ongoing attention to the vulnerability.

Official resources