CVE-2026-4720 covers a set of memory safety bugs affecting Mozilla Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148. These bugs showed evidence of memory corruption, which could be exploited to execute arbitrary code with no privileges or user interaction required. The vulnerabilities were fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. The vendor advisory confirms the fixes and categorizes the impact as high. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of these memory safety bugs could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected systems. The vulnerabilities are critical due to their potential to be exploited remotely without authentication or user interaction.

Official fixes are available and have been released by Mozilla. Users and administrators should update affected products to Firefox 149, Firefox ESR 140.9, Thunderbird 149, or Thunderbird ESR 140.9 to remediate these vulnerabilities. No additional mitigation actions are required beyond applying these updates.