CVE-2026-4706
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Mar 24, 2026
CISA due date
—
The record
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | firefox | 0 | 149.0-r0 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| Wolfi | firefox | 0 | 149.0-r0 |
| openSUSE:Leap 15.6 | MozillaFirefox | 0 | 140.9.0-150200.152.225.1 |
| openSUSE:Leap 15.6 | MozillaThunderbird | 0 | 140.9.0-150200.8.263.1 |
| openSUSE:Leap 16.0 | MozillaFirefox | 0 | 140.9.0-160000.1.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 149.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.9.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 140.9.0-1.1 |
Related vulnerabilities
- CVE-2026-4726 Denial-of-service in the XML component. Also affects firefox
- CVE-2026-4724 Undefined behavior in the Audio/Video component. Also affects firefox
- CVE-2026-4729 Memory safety bugs present in Firefox 148 and Thunderbird 148. Also affects firefox
- CVE-2026-4722 Privilege escalation in the IPC component. Also affects firefox
- CVE-2026-4723 Use-after-free in the JavaScript Engine component. Also affects firefox
- CVE-2026-4727 Denial-of-service in the Libraries component in NSS. Also affects firefox
- CVE-2026-4728 Spoofing issue in the Privacy: Anti-Tracking component. Also affects firefox
- CVE-2026-4725 Sandbox escape due to use-after-free in the Graphics: Canvas2D component. Also affects firefox