CVE-2026-4694 is a vulnerability in the Graphics component of Mozilla Firefox characterized by incorrect boundary conditions and an integer overflow. It is classified under CWE-754 and has a CVSS 3.1 base score of 7.5, indicating high severity. The vulnerability was reported by Sajeeb Lohani and fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vendor advisories confirm the fix and provide references to the underlying bug (Bug 2018430). This vulnerability is part of a broader set of memory safety and boundary condition issues addressed in the same release cycle.

The vulnerability has a high impact rating with a CVSS score of 7.5, primarily due to the potential for denial-of-service (availability impact). The integer overflow and incorrect boundary conditions in the graphics processing could cause crashes or other disruptions. There is no confirmed evidence of exploitation in the wild. The issue affects Firefox and Thunderbird versions prior to the fixed releases.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.