CVE-2026-4708 is an incorrect boundary conditions vulnerability in the Graphics component of Mozilla Firefox. It was fixed in Firefox 149 and Firefox ESR 140.9. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a network-exploitable issue that can cause a high impact on availability without compromising confidentiality or integrity. This vulnerability is part of a broader set of memory safety and boundary condition issues addressed in the same Firefox releases. The official Mozilla advisories confirm the fix and provide references to the underlying bugs.

The vulnerability can lead to a high impact on availability, potentially causing denial of service conditions in affected Firefox versions prior to 149 and ESR 140.9. There is no indication of confidentiality or integrity compromise from this specific vulnerability. No known active exploitation has been reported. The vulnerability affects Firefox and Thunderbird clients running vulnerable versions.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.