CVE-2026-4724: 
NixOS vulnerability analysis and mitigation

CVE-2026-4724 is an undefined behavior vulnerability in the Audio/Video component of Mozilla Firefox and Thunderbird. It affects all versions of Firefox prior to 149.0 and Thunderbird prior to 149.0. The vulnerability was disclosed on March 24, 2026, as part of Mozilla Foundation Security Advisory MFSA2026-20 (Firefox) and MFSA2026-23 (Thunderbird). Mozilla rates its impact as moderate, while the CVSS v3.1 base score assigned by Red Hat is 9.1 (Critical) (Mozilla Advisory MFSA2026-20, Mozilla Advisory MFSA2026-23, Red Hat Bugzilla).

The vulnerability is classified under CWE-475 (Undefined Behavior for Input to API) and CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior), indicating that the Audio/Video processing component invokes undefined behavior — likely through improper handling of media input — that can produce unpredictable and potentially exploitable program states. The CVSS vector indicates network-accessible exploitation with no privileges required and no user interaction needed, suggesting the flaw can be triggered by processing specially crafted media content. The vulnerability was discovered and reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, making it a notable example of AI-assisted vulnerability research (Mozilla Advisory MFSA2026-20, Red Hat Bugzilla).

Successful exploitation could result in high confidentiality and high integrity impact, potentially enabling arbitrary code execution or sensitive data exfiltration through maliciously crafted media content processed by Firefox or Thunderbird. Availability is not directly impacted per the CVSS scoring. In Thunderbird, Mozilla notes that scripting-based flaws generally cannot be exploited via email due to disabled scripting in the mail reader, but the vulnerability remains a risk in browser or browser-like contexts (Mozilla Advisory MFSA2026-23, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000050 (approximately 0.005%), reflecting a low near-term exploitation probability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 386906) and Tenable Nessus (IDs: 303888, 304141) (Mozilla Advisory MFSA2026-20).

Mozilla has released patches addressing this vulnerability in Firefox 149 and Thunderbird 149. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation. Enterprise deployments should prioritize patching given the high CVSS score and the lack of user interaction required for exploitation (Mozilla Advisory MFSA2026-20, Mozilla Advisory MFSA2026-23).

The vulnerability attracted notable attention due to its discovery method: it was found by a team of researchers using Anthropic's Claude AI model, representing a high-profile example of AI-assisted security research contributing to browser vulnerability discovery. VulnCheck published a blog post specifically covering CVEs credited to Anthropic, highlighting this trend (VulnCheck Blog). Coverage also appeared in security news outlets noting Firefox 149's release patched 37 vulnerabilities, with this CVE among those attributed to AI-assisted research (CyberSecurityNews).