CVE-2026-4699: 
NixOS vulnerability analysis and mitigation

CVE-2026-4699 is a vulnerability caused by incorrect boundary conditions in the Layout: Text and Fonts component of Mozilla Firefox and Thunderbird. Discovered and reported by Matej Smycka, it was publicly disclosed on March 24, 2026, as part of Mozilla's coordinated security advisory release. Affected versions include Firefox prior to 149, Firefox ESR prior to 115.34, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird ESR prior to 140.9. It carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22).

The vulnerability is rooted in improper boundary checking within Firefox's Layout: Text and Fonts subsystem, classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-787 (Out-of-bounds Write). The incorrect boundary conditions can lead to an out-of-bounds write condition when the browser processes specially crafted text or font-related content. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, making it exploitable remotely by any unauthenticated attacker who can deliver malicious content to a vulnerable browser. The underlying bug is tracked as Mozilla bug 2021863, though the bug report is access-restricted (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22).

Successful exploitation of CVE-2026-4699 primarily impacts availability, with a CVSS availability impact rated High and no direct confidentiality or integrity impact indicated by the base score. An out-of-bounds write in the text and fonts layout engine could cause the browser or email client to crash, resulting in a denial-of-service condition for affected users. Given the network-accessible attack vector and no user interaction requirement, a malicious web page or email could trigger this condition against any unpatched Firefox or Thunderbird user, potentially affecting a broad population of end users (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-4699 as of the available data. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Mozilla has released patched versions addressing CVE-2026-4699: Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update to these versions immediately. No configuration-based workarounds have been published; upgrading to a fixed release is the only recommended remediation. Downstream Linux distributions including Red Hat, AlmaLinux, Rocky Linux, Debian, openSUSE, and Amazon Linux have also released updated packages (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-21, Mozilla Advisory mfsa2026-22).

The vulnerability was disclosed as part of a large batch of Mozilla security fixes on March 24, 2026, covering Firefox 149 and associated ESR releases. Security news outlets such as CyberSecurityNews and HealSecurity covered the Firefox 149 release, noting it addressed 37 vulnerabilities. Downstream vendors including Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, and Amazon Linux promptly issued updated packages, reflecting standard industry response to Mozilla security advisories. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-4699 has been identified beyond routine patch coverage (Mozilla Advisory mfsa2026-20).