CVE-2026-4685 involves incorrect boundary conditions in the Graphics: Canvas2D component of Mozilla Firefox, which can cause memory safety issues. The vulnerability was assigned a CVSS v3.1 score of 7.5 (high) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). Mozilla addressed this vulnerability in Firefox 149 and corresponding ESR and Thunderbird versions. Multiple related bugs were fixed simultaneously as part of a broader security update. The vendor advisories provide authoritative confirmation of the fix and detailed references to the underlying bugs.

The vulnerability impacts the availability of the affected software by potentially causing denial-of-service conditions due to incorrect boundary checks in the Canvas2D graphics component. There is no confirmed impact on confidentiality or integrity. No exploits in the wild have been reported, but the high CVSS score indicates a significant risk if exploited. The flaw could be leveraged remotely without authentication or user interaction.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, local patching is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed by Mozilla advisories.