Description
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published: 2026-03-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial-of-service
Action: Immediate Patch
AI Analysis

Impact

A denial-of-service vulnerability exists in the WebRTC Signaling component of Mozilla products. The flaw can cause the application to consume excessive resources or crash, rendering it unresponsive to legitimate users. It is identified by CWE-400 and CWE-770 and has a CVSS score of 7.5.

Affected Systems

Mozilla Firefox versions earlier than 149 and Firefox ESR earlier than 140.9, as well as Mozilla Thunderbird versions earlier than 149 and Thunderbird ESR earlier than 140.9, are affected by this flaw. Users running these releases risk interruption of WebRTC-enabled features.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. It is not included in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote and would require the receipt of a malicious WebRTC signaling message, which a user might encounter when visiting a compromised or malicious website.

Generated by OpenCVE AI on March 26, 2026 at 04:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 149 or later, or to Firefox ESR 140.9 or later.
  • Upgrade Mozilla Thunderbird to version 149 or later, or to Thunderbird ESR 140.9 or later.
  • If an immediate update is not possible, disable WebRTC in the browser settings as a temporary mitigation.
  • Regularly check Mozilla’s security advisories for updates and patches.

Generated by OpenCVE AI on March 26, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4510-1 firefox-esr security update
Debian DLA Debian DLA DLA-4511-1 thunderbird security update
Debian DSA Debian DSA DSA-6178-1 firefox-esr security update
Debian DSA Debian DSA DSA-6179-1 thunderbird security update
History

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Thu, 26 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 25 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla firefox Esr
Vendors & Products Mozilla firefox Esr

Tue, 24 Mar 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Tue, 24 Mar 2026 20:30:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9. Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
References

Tue, 24 Mar 2026 12:45:00 +0000

Type Values Removed Values Added
Description Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.
Title Denial-of-service in the WebRTC: Signaling component
References

Subscriptions

Mozilla Firefox Firefox Esr
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T13:50:34.107Z

Reserved: 2026-03-23T23:22:09.666Z

Link: CVE-2026-4704

cve-icon Vulnrichment

Updated: 2026-03-25T17:50:53.144Z

cve-icon NVD

Status : Modified

Published: 2026-03-24T13:16:06.303

Modified: 2026-04-13T15:17:40.207

Link: CVE-2026-4704

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-24T12:30:32Z

Links: CVE-2026-4704 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:20:04Z

Weaknesses