CVE-2026-4696

The vulnerability consists of a use-after-free error in the Layout: Text and Fonts component — an area of the browser engine responsible for processing and displaying text and fonts. This type of error means that the program references a memory area that has already been freed, which can lead to execution of code controlled by the attacker. The attack vector is network-based, with no authentication requirement and no need for any user interaction on the victim's side (CVSS AV:N/AC:L/PR:N/UI:N).

An attacker can gain full control over the victim's system through remote code execution (RCE), and can also lead to violations of confidentiality, integrity, and availability of data — all three categories rated as high in the CVSS vector.

Software must be updated immediately to the following versions: Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9, in which the vulnerability has been fixed. Patches are available directly from the vendor and in the references indicated in the description.

Mozilla Firefox versions prior to 149, Mozilla Firefox ESR versions prior to 115.34 and prior to 140.9, Mozilla Thunderbird versions prior to 149 and prior to 140.9.