CVE-2026-4686 is a vulnerability involving incorrect boundary conditions in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. This issue was reported by Sajeeb Lohani and is tracked under Bug 2016351. It was fixed in Firefox 149 and ESR versions 115.34 and 140.9, as well as corresponding Thunderbird versions. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and an impact on availability but not confidentiality or integrity. The vulnerability is part of a set of memory safety bugs fixed in these releases, some of which could potentially allow arbitrary code execution if exploited. Mozilla's multiple security advisories confirm the fix and provide detailed references.

The vulnerability affects the availability of the Firefox and Thunderbird applications by potentially causing crashes or denial-of-service conditions due to incorrect boundary checks in the Canvas2D graphics component. While the CVSS score indicates no direct impact on confidentiality or integrity, the presence of memory safety bugs in the same release suggests that exploitation could lead to more severe consequences if combined with other vulnerabilities. There are no known exploits in the wild currently.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, manual patching is required. Patch status is confirmed by Mozilla's security advisories linked in the vendor advisory content.