PatchSiren cyber security CVE debrief
CVE-2026-4695 Mozilla CVE debrief
CVE-2026-4695 is a HIGH-severity vulnerability affecting the Audio/Video: Web Codecs component. The issue involves incorrect boundary conditions and was addressed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability was publicly disclosed on March 24, 2026, and the CVE record was last modified on June 30, 2026. The CVSS score for this vulnerability is 7.5. The CVE record indicates that the vulnerability was fixed in multiple Mozilla products, including Firefox and Thunderbird. The NVD provides detailed information about the vulnerability, including its CVSS vector and weaknesses.
- Vendor
- Mozilla
- Product
- Firefox
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-03-24
- Original CVE updated
- 2026-07-15
- Advisory published
- 2026-03-24
- Advisory updated
- 2026-07-15
Who should care
Organizations and individuals using Mozilla Firefox, Firefox ESR, Thunderbird, or Thunderbird should prioritize patching this vulnerability. The HIGH severity rating and CVSS score of 7.5 indicate that this vulnerability could have significant impacts if exploited. Users of affected products should update to the latest versions to mitigate potential risks.
Technical summary
The CVE-2026-4695 vulnerability is related to incorrect boundary conditions in the Audio/Video: Web Codecs component. This issue could potentially allow attackers to exploit the vulnerability remotely. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that the vulnerability can be exploited over the network with low attack complexity and no privileges required. The weaknesses associated with this vulnerability include CWE-754 and CWE-131.
Defensive priority
Patching is the primary recommended action for CVE-2026-4695. Organizations should prioritize updating Firefox to version 149 or later, Firefox ESR to version 140.9 or later, Thunderbird to version 149 or later, and Thunderbird to version 140.9 or later. Additionally, defenders should consider monitoring for potential exploitation attempts and ensuring that compensating controls are in place if immediate patching is not feasible.
Recommended defensive actions
- Patch Firefox to version 149 or later
- Patch Firefox ESR to version 140.9 or later
- Patch Thunderbird to version 149 or later
- Patch Thunderbird to version 140.9 or later
- Monitor for potential exploitation attempts
- Review and update inventory of affected products
Evidence notes
The CVE record and NVD detail provide official information about the vulnerability. Multiple vendor advisories and references are available, including those from Mozilla and Red Hat. The CVE record was last modified on June 30, 2026, indicating ongoing attention to the vulnerability.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-4695 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-4695
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-4695 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4695
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://www.mozilla.org/security/advisories/mfsa2026-20/
[email protected] - Vendor Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://www.mozilla.org/security/advisories/mfsa2026-22/
[email protected] - Vendor Advisory
-
Source reference
Unverified legacy reference
URL: https://www.mozilla.org/security/advisories/mfsa2026-23/
-
Source reference
Unverified legacy reference
URL: https://www.mozilla.org/security/advisories/mfsa2026-24/
-
Source reference
Unverified legacy reference
URL: https://access.redhat.com/errata/RHSA-2026:5930
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
-
Source reference
Unverified legacy reference
URL: https://access.redhat.com/errata/RHSA-2026:5931
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.