Improper Boundary Condition in Audio/Video Component of Firefox
CVE-2026-4709

7.5HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
24 March 2026

What is CVE-2026-4709?

This vulnerability arises from incorrect boundary conditions within the Audio/Video: GMP component, which can potentially be exploited by malicious content. It impacts various ranges of Firefox versions including those prior to 149 and certain Extended Support Release (ESR) versions. Users of affected Firefox products should apply security patches and updates promptly to mitigate potential risks.

Affected Version(s)

Firefox < 149

Firefox ESR < 115.34

Firefox ESR < 140.9

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2016329
https://bugzilla.mozilla.org/show_bug.cgi?id=2016342
https://www.mozilla.org/security/advisories/mfsa2026-20/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sajeeb Lohani
.