Description
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published: 2026-03-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential memory corruption
Action: Patch
AI Analysis

Impact

The issue is an incorrect handling of boundary conditions within the Audio/Video: Web Codecs component used by Mozilla applications, which may lead to memory corruption. The vulnerability is categorized under CWE‑131 (Incorrect Buffer Size Calculation) and CWE‑754 (Improper Handling of the Procedure Chain).

Affected Systems

Mozilla Firefox (all builds) versions earlier than 149 and Firefox ESR versions earlier than 140.9, as well as Mozilla Thunderbird versions earlier than 149 and Thunderbird ESR versions earlier than 140.9, are affected.

Risk and Exploitability

The CVSS score of 7.5 places this issue in the high‑risk category, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not included in the CISA KEV catalog. The likely attack vector, inferred from the nature of the component, involves an attacker supplying a malformed audio or video file that the browser or Thunderbird processes, which could trigger the boundary failure.

Generated by OpenCVE AI on March 26, 2026 at 05:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Mozilla Firefox update (v149 or newer, or the latest ESR 140.9 or newer).
  • Apply the latest Mozilla Thunderbird update (v149 or newer, or the latest ESR 140.9 or newer).
  • Avoid opening or processing untrusted audio or video files until the vulnerability is addressed.
  • Continue monitoring Mozilla security advisories for additional guidance.

Generated by OpenCVE AI on March 26, 2026 at 05:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4510-1 firefox-esr security update
Debian DLA Debian DLA DLA-4511-1 thunderbird security update
Debian DSA Debian DSA DSA-6178-1 firefox-esr security update
Debian DSA Debian DSA DSA-6179-1 thunderbird security update
History

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Thu, 26 Mar 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-131
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla firefox Esr
Vendors & Products Mozilla firefox Esr

Tue, 24 Mar 2026 20:30:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9. Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
References

Tue, 24 Mar 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Weaknesses CWE-754
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Tue, 24 Mar 2026 12:45:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.
Title Incorrect boundary conditions in the Audio/Video: Web Codecs component
References

Subscriptions

Mozilla Firefox Firefox Esr
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T13:48:56.241Z

Reserved: 2026-03-23T23:21:52.856Z

Link: CVE-2026-4695

cve-icon Vulnrichment

Updated: 2026-03-26T12:55:30.338Z

cve-icon NVD

Status : Modified

Published: 2026-03-24T13:16:05.473

Modified: 2026-04-13T15:17:38.630

Link: CVE-2026-4695

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-24T12:30:26Z

Links: CVE-2026-4695 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:20:14Z

Weaknesses