CVE-2026-4697 describes a memory safety vulnerability caused by incorrect boundary conditions in the Audio/Video: Web Codecs component of Mozilla Firefox. This flaw could lead to a denial-of-service condition (availability impact) due to improper handling of boundary checks. The vulnerability was fixed in Firefox 149 and Firefox ESR 140.9 as part of a comprehensive update addressing multiple memory safety issues across Firefox and Thunderbird. The CVSS vector indicates the vulnerability is remotely exploitable without privileges or user interaction, affecting the availability of the application. No known active exploits have been reported.

The vulnerability can cause a denial-of-service condition in Firefox through improper boundary checking in the Web Codecs component. While no direct confidentiality or integrity impacts are noted, the high CVSS score reflects the potential for significant disruption of service. There is no evidence of exploitation in the wild. The fix in Firefox 149 and ESR 140.9 mitigates the risk.

Users and administrators should update Firefox and Thunderbird to version 149 or Firefox ESR to version 140.9 or later, where this vulnerability and related memory safety bugs have been fixed. No additional mitigations are required as the vendor has provided an official fix. Patch status is confirmed by the Mozilla security advisories MFSA 2026-20 and MFSA 2026-22.