CVE-2026-4705
Published: 24 March 2026
Description
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, prioritization, and patching of flaws like CVE-2026-4705 in Firefox and Thunderbird WebRTC signaling component.
Requires vulnerability scanning to identify unpatched instances of CVE-2026-4705 in deployed Mozilla browsers and clients.
Ensures dissemination of and response to security advisories like MFSA2026-20 documenting CVE-2026-4705 and its patches.
Security SummaryAI
CVE-2026-4705 involves undefined behavior in the WebRTC Signaling component, affecting Mozilla Firefox and Thunderbird products. The vulnerability was addressed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9, meaning earlier versions remain susceptible. It carries associated CWEs including NVD-CWE-noinfo and CWE-758, and was published on 2026-03-24.
Attackers can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and without changing the scope (S:U). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 9.8.
Mozilla's security advisories, including MFSA2026-20, MFSA2026-22, MFSA2026-23, and MFSA2026-24, along with Bugzilla entry 2014873, document the issue and confirm fixes in the specified versions as the primary mitigation. Security practitioners should prioritize updating affected browsers and email clients to patched releases.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Undefined behavior in WebRTC signaling component with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates remote client-side memory corruption or code execution flaw in Firefox/Thunderbird; directly enables T1203 (Exploitation for Client Execution) via malicious WebRTC signaling without requiring privileges or explicit user interaction beyond normal app usage.