CVE-2026-4685

CVE-2026-4685 is a vulnerability involving incorrect boundary conditions in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 149, Firefox ESR prior to 115.34 and 140.9, and Thunderbird prior to 149 and 140.9. The issue, classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions), carries a CVSS v3.1 base score of 7.5, reflecting high severity due to its potential for denial-of-service impacts.

A remote attacker requires no privileges or user interaction to exploit this vulnerability over the network with low complexity. By crafting malicious content that triggers the boundary condition flaw in Canvas2D rendering, an attacker can cause the affected browser or mail client to crash, resulting in a denial of service with high availability impact but no compromise of confidentiality or integrity.

Mozilla's security advisories (MFSA 2026-20 through 2026-23) and the associated Bugzilla entry detail the fix applied in the listed versions. Security practitioners should prioritize updating to Firefox 149, Firefox ESR 115.34 or 140.9, Thunderbird 149, or Thunderbird 140.9 to mitigate the issue.