CVE-2026-4709 is a vulnerability caused by incorrect boundary conditions in the Audio/Video: GMP component of Mozilla Firefox and Thunderbird. This flaw could result in a high-impact issue affecting application availability (denial-of-service). The vulnerability is tracked under CWE-754 (Improper Check for Unusual or Exceptional Conditions). It was addressed and fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The CVSS v3.1 base score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. Mozilla’s security advisories confirm the fix and provide references to the relevant bug reports.

The vulnerability impacts the availability of the affected Mozilla Firefox and Thunderbird versions by potentially causing a denial-of-service condition due to incorrect boundary checks in the Audio/Video: GMP component. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.