CVE-2026-4719 concerns incorrect boundary conditions in the Graphics: Text component of Mozilla Firefox, categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). This memory safety issue was fixed in Firefox 149 and Firefox ESR 140.9 as part of a wider security update addressing multiple memory safety bugs. The CVSS v3.1 base score is 7.5 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability (denial of service). The vendor advisory confirms the fix and does not report any active exploitation.

The vulnerability could lead to denial-of-service conditions due to memory corruption in the Graphics: Text component. While the CVSS score indicates high severity, the advisory rates the impact of this specific issue as low, likely reflecting limited confidentiality or integrity impact. No evidence of exploitation in the wild has been reported. The broader set of memory safety bugs fixed alongside this vulnerability includes some with potential for arbitrary code execution, but CVE-2026-4719 itself is not indicated as exploitable for code execution.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update to these or later versions to remediate the issue. No additional mitigation steps are required beyond applying the official patches.