CVE-2026-4697: 
NixOS vulnerability analysis and mitigation

CVE-2026-4697 is a vulnerability caused by incorrect boundary conditions in the Audio/Video: Web Codecs component of Mozilla Firefox and Thunderbird. It was reported by a researcher identified as "Lorenzo" and disclosed on March 24, 2026, as part of Mozilla's coordinated security advisory release. Affected versions include Firefox prior to 149, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird ESR prior to 140.9. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The root cause is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-787 (Out-of-bounds Write), stemming from incorrect boundary condition checks within the Web Codecs media processing component. An attacker can exploit this remotely over the network without requiring authentication or user interaction, by supplying maliciously crafted audio or video codec data that triggers an out-of-bounds write condition. The vulnerability is tracked internally by Mozilla as Bug 2020422, though the bug report is access-restricted (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

Successful exploitation of CVE-2026-4697 primarily impacts availability, with a high availability impact and no direct confidentiality or integrity impact per the CVSS scoring. An attacker could cause a denial-of-service condition by crashing the affected Firefox or Thunderbird process through a maliciously crafted media stream. Given the out-of-bounds write nature of the flaw, there is a theoretical risk that memory corruption could be leveraged for further exploitation in combination with other vulnerabilities, though no such chaining has been publicly documented (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-4697 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified (Feedly).

Mozilla has released patched versions addressing this vulnerability: Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading to a fixed release is the only recommended remediation (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9). Downstream Linux distributions including Red Hat, AlmaLinux, Rocky Linux, Debian, openSUSE, and Amazon Linux have also issued updated packages.

CVE-2026-4697 was disclosed as part of a large batch of 37+ vulnerabilities fixed in Firefox 149, which received coverage from security news outlets such as CyberSecurityNews and HealSecurity, noting the breadth of the release. Downstream vendors including Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, and Amazon Linux promptly issued security advisories and updated packages. No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified beyond routine patch coverage.