CVE-2026-4710: 
NixOS vulnerability analysis and mitigation

CVE-2026-4710 is a memory safety vulnerability caused by incorrect boundary conditions in the Audio/Video component of Mozilla Firefox and Thunderbird. Discovered and reported by security researcher Sajeeb Lohani, it was publicly disclosed on March 24, 2026, as part of Mozilla's coordinated release of Firefox 149 and Firefox ESR 140.9. The vulnerability affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird ESR versions prior to 140.9. Mozilla rates its impact as moderate in its official advisories, though Feedly's automated CVSS v3.1 estimate assigns a base score of 9.8 (Critical) — this discrepancy reflects the difference between automated scoring and Mozilla's manual severity assessment (Mozilla Advisory Firefox 149, Mozilla Advisory Firefox ESR 140.9).

The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), stemming from incorrect boundary condition checks in Firefox's and Thunderbird's Audio/Video media processing component. When processing specially crafted audio or video content, the browser fails to properly validate buffer boundaries, potentially allowing memory writes beyond allocated buffer regions. The flaw is referenced internally as Mozilla bug 2016370, though the bug report is access-restricted. No public technical write-up or proof-of-concept code has been identified at this time (Mozilla Advisory Firefox 149, Mozilla Advisory Firefox ESR 140.9).

Successful exploitation of this out-of-bounds write vulnerability could allow an attacker to corrupt memory in the browser process, potentially leading to arbitrary code execution, application crashes (denial of service), or information disclosure. Given the network-accessible attack surface of a browser's media processing pipeline, a malicious web page or email containing crafted audio/video content could trigger the vulnerability when rendered by an affected Firefox or Thunderbird instance. The practical impact is constrained by Mozilla's sandbox architecture, which may limit the ability to escalate from a renderer compromise to full system access without chaining additional vulnerabilities (Mozilla Advisory Firefox 149, Mozilla Advisory Firefox ESR 140.9).

As of the time of this report, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-4710. The EPSS score is extremely low at 0.000060, reflecting a very low probability of exploitation in the near term. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Mozilla has released patched versions addressing CVE-2026-4710: Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update to these versions immediately. Downstream Linux distributions including Red Hat, AlmaLinux, Rocky Linux, Debian, openSUSE, Slackware, and Amazon Linux have also released updated packages. As a temporary workaround prior to patching, organizations may consider restricting access to untrusted audio/video content or disabling media playback in browser policies where operationally feasible (Mozilla Advisory Firefox 149, Mozilla Advisory Firefox ESR 140.9).

The vulnerability was part of a large batch of 37+ security fixes released with Firefox 149 on March 24, 2026, which received coverage from security news outlets including CyberSecurityNews and HealSecurity. Mozilla rated CVE-2026-4710 as moderate severity in its official advisories, which contrasts with the automated CVSS 9.8 Critical score assigned by some vulnerability databases — a discrepancy that may cause confusion for patch prioritization. Downstream vendors including Red Hat, AlmaLinux, Rocky Linux, Debian, and openSUSE promptly issued their own security advisories and updated packages following Mozilla's disclosure (Mozilla Advisory Firefox 149).