CVE-2026-4694 is a vulnerability caused by incorrect boundary conditions and an integer overflow within the Graphics component of Mozilla Firefox. The issue was identified and fixed by Mozilla in Firefox 149 and corresponding ESR versions 115.34 and 140.9. The vulnerability is categorized under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-190 (Integer Overflow or Wraparound). It has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability. The vendor advisory confirms the fix and recommends updating to the patched versions. No evidence of exploitation in the wild has been reported.

The vulnerability can cause a denial-of-service (availability impact) due to incorrect boundary checks and integer overflow in the Graphics component. While no direct confidentiality or integrity impacts are indicated, the high CVSS score and memory safety context suggest potential for significant disruption if exploited. No known active exploits have been reported.

Mozilla has released official patches fixing this vulnerability in Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9. Users and administrators should update affected Firefox installations to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.