CVE-2026-4715 describes a critical memory safety vulnerability caused by uninitialized memory usage in the Graphics: Canvas2D component of Mozilla Firefox. This flaw could potentially lead to memory corruption and other security issues. It was fixed in Firefox 149 and Firefox ESR 140.9 as part of a comprehensive security update addressing multiple memory safety bugs across Firefox and Thunderbird products. The vulnerability has a CVSS 3.1 base score of 9.1, reflecting its critical impact with network attack vector, no required privileges or user interaction, and high confidentiality and availability impacts. The Mozilla Foundation has released official patches resolving this issue.

The vulnerability allows potential exploitation leading to memory corruption, which could result in denial of service or other impacts affecting confidentiality and availability. The CVSS score of 9.1 indicates critical severity. However, there are no known active exploits in the wild. The issue is mitigated by the official fixes released by Mozilla in Firefox 149 and Firefox ESR 140.9.

Users and administrators should update affected Mozilla Firefox installations to version 149 or later, or Firefox ESR 140.9 or later, where this vulnerability has been officially fixed. No additional mitigation actions are required beyond applying the official patches as provided by Mozilla. The vendor advisory confirms that the vulnerability is resolved in these versions.