CVE-2026-4695 involves incorrect boundary conditions in the Audio/Video: Web Codecs component of Mozilla Firefox. This type of vulnerability can lead to memory safety issues such as buffer overflows or out-of-bounds access, potentially causing denial of service. The vulnerability was reported by Atte Kettunen and fixed in Firefox 149 and Firefox ESR 140.9. It is one of multiple high-impact security issues addressed simultaneously by Mozilla in these releases. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with an impact limited to availability.

The vulnerability can cause denial of service by crashing the affected component, impacting the availability of Firefox. There is no direct impact on confidentiality or integrity reported. The CVSS score of 7.5 reflects a high severity primarily due to the potential for remote exploitation without user interaction. No active exploitation in the wild has been observed according to the vendor advisory.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update to these or later versions to remediate the issue. Since this is not a cloud service, local patching is required. No additional mitigation steps are indicated by the vendor advisory.