CVE-2026-4716

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Score

CVSS 3.1 9.1 Critical

Status

Modified - security@mozilla.org

Published

2026-03-24

Last modified

2026-04-13

Weaknesses

CWE-908

Affected products

• Firefox (Mozilla)
• Thunderbird (Mozilla)

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2018592
• https://www.mozilla.org/security/advisories/mfsa2026-20/
• https://www.mozilla.org/security/advisories/mfsa2026-22/
• https://www.mozilla.org/security/advisories/mfsa2026-23/
• https://www.mozilla.org/security/advisories/mfsa2026-24/