CVE-2026-4695: 
NixOS vulnerability analysis and mitigation

CVE-2026-4695 is a vulnerability caused by incorrect boundary conditions in the Audio/Video: Web Codecs component of Mozilla Firefox and Thunderbird. It was discovered by security researcher Atte Kettunen and publicly disclosed on March 24, 2026, as part of Mozilla's coordinated release of Firefox 149 and Firefox ESR 140.9. Affected versions include Firefox prior to 149.0 and Firefox ESR prior to 140.9.0, as well as the corresponding Thunderbird releases. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The root cause is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-131 (Incorrect Calculation of Buffer Size), reflecting a failure to properly validate boundary conditions when processing Web Codecs audio/video data. An attacker can exploit this remotely over the network without authentication or user interaction by supplying maliciously crafted media content that triggers the incorrect boundary check in the Web Codecs component. The attack vector is network-based with low complexity, and no privileges are required, making it straightforward to trigger from a remote context. The underlying bug is tracked as Mozilla Bug 2020030, though the bug report is access-restricted (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

Successful exploitation of CVE-2026-4695 primarily affects availability, with a high availability impact and no direct confidentiality or integrity impact per the CVSS scoring. An attacker delivering specially crafted audio/video content via the Web Codecs API could cause the browser or email client to crash or become unresponsive, resulting in a denial-of-service condition. Given the network-accessible attack vector and lack of required user interaction, this vulnerability could be triggered at scale against users of unpatched Firefox or Thunderbird installations (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-4695 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability has been detected by multiple vulnerability scanners including Qualys and Nessus, facilitating identification of unpatched systems (Mozilla Advisory Firefox 149).

Mozilla has released patches addressing CVE-2026-4695 in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading to a patched release is the only recommended remediation. Enterprise administrators should prioritize patching both Firefox and Thunderbird deployments, particularly in environments where users process untrusted media content (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability was part of a large batch of 37+ security fixes released with Firefox 149 on March 24, 2026, which received coverage from security news outlets such as CyberSecurityNews and HealSecurity. Multiple Linux distributions including Debian, openSUSE, Red Hat, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, Slackware, and Mageia issued downstream security advisories and updated packages. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-4695 has been identified beyond standard patch coverage (Mozilla Advisory Firefox 149).