CVE-2026-4699 describes a security flaw in Mozilla Firefox's Layout: Text and Fonts component caused by incorrect boundary conditions. This issue was identified and fixed in Firefox 149 and ESR versions 115.34 and 140.9, along with Thunderbird updates. The vulnerability is categorized under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and has a CVSS v3.1 base score of 7.5, indicating high severity. The flaw could cause denial-of-service impacts due to memory safety issues but does not directly affect confidentiality or integrity. Mozilla addressed this vulnerability as part of a broad security update that fixed multiple memory safety bugs across Firefox and Thunderbird products.

The vulnerability impacts availability by potentially causing denial-of-service conditions through memory safety violations in the Layout: Text and Fonts component. There is no direct impact on confidentiality or integrity reported. No evidence of exploitation in the wild has been observed. The CVSS score of 7.5 reflects a high severity due to the network attack vector, low attack complexity, and no required privileges or user interaction.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.