CVE-2026-4713: 
NixOS vulnerability analysis and mitigation

CVE-2026-4713 is a vulnerability caused by incorrect boundary conditions in the Graphics component of Mozilla Firefox and Thunderbird. Reported by Sajeeb Lohani, it was disclosed and patched on March 24, 2026, as part of Mozilla Foundation Security Advisories MFSA2026-20 and MFSA2026-22. Affected versions include Firefox prior to 149, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird ESR prior to 140.9. It carries a CVSS v3.1 base score of 7.5 (High), with the primary impact being availability (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-787 (Out-of-bounds Write), stemming from incorrect boundary condition checks within Firefox's Graphics rendering component. The flaw can be triggered remotely over the network without authentication or user interaction, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N). The underlying bug is tracked as Mozilla Bug 2018113, though the bug report is access-restricted. No public technical write-ups or proof-of-concept code have been identified at this time (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The primary impact of CVE-2026-4713 is a denial-of-service condition, with high availability impact and no direct confidentiality or integrity impact per the CVSS scoring. Exploitation could cause the browser or email client to crash or become unresponsive when processing malicious graphical content. Given the network-accessible attack vector and lack of required user interaction, a remote attacker could potentially trigger this condition against any user visiting a crafted web page or receiving a malicious email rendered by Thunderbird (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified for CVE-2026-4713. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.015%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (Mozilla Advisory ESR 140.9).

Mozilla has released patched versions addressing CVE-2026-4713: Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the recommended and only confirmed remediation (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9). Linux distribution vendors including Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, and Amazon Linux have also issued updated packages.

Mozilla disclosed CVE-2026-4713 as part of a large batch of security fixes in Firefox 149 and Firefox ESR 140.9, released on March 24, 2026. Security news outlets such as CyberSecurityNews and HealSecurity covered the Firefox 149 release, noting the broad scope of 37+ vulnerabilities addressed. Multiple Linux distribution vendors (Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux) promptly issued updated packages, reflecting standard industry response to Mozilla security advisories. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified.