CVE-2026-4707 describes a security vulnerability in the Graphics: Canvas2D component of Mozilla Firefox characterized by incorrect boundary conditions. This flaw could affect memory safety and impact the availability of the affected software. The vulnerability has been assigned a CVSS v3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. Mozilla fixed this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vendor advisory confirms the fix and provides references to the underlying bug reports.

The vulnerability can cause a denial-of-service condition by exploiting incorrect boundary conditions in the Canvas2D graphics component, impacting the availability of Firefox and Thunderbird. There is no confirmed evidence of confidentiality or integrity impact. No known exploits in the wild have been reported. The high CVSS score reflects the potential for disruption without requiring user interaction or privileges.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official patches.