The vulnerability CVE-2026-4718 pertains to undefined behavior in the WebRTC signaling component of Mozilla Firefox. It was fixed in Firefox 149 and Firefox ESR 140.9. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. The vendor advisory confirms the fix is available in these versions. This vulnerability is part of a broader set of memory safety and boundary condition issues addressed in the same release.

The vulnerability could lead to high confidentiality and integrity impacts if exploited, as indicated by the CVSS vector. However, exploitation requires user interaction and no privileges are needed, which somewhat limits the attack surface. There are no known exploits in the wild at this time. The issue is resolved in Firefox 149 and ESR 140.9, mitigating the risk for updated users.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official patches.