Security Resilience

CVE-2026-4693

Mozilla Firefox ≤ 115.34.0

Published
24 March 2026
Modified
15 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0069 52th percentile
Risk Priority 59 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-4693 is a high-severity Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-4693 is a vulnerability involving incorrect boundary conditions in the Audio/Video: Playback component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 149, Firefox ESR prior to 115.34 and 140.9, and Thunderbird prior to 149 and 140.9. The issue is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and carries a CVSS v3.1 base score of 7.5.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation results in a denial-of-service condition due to high availability impact, with no effects on confidentiality or integrity.

Mozilla security advisories (MFSA 2026-20 through 2026-23) and the associated Bugzilla entry detail the fix applied in the specified versions of Firefox and Thunderbird, recommending immediate upgrades to patched releases for mitigation.

OWASP Top 10 for Web (2025)

A10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability Data

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CWE(s)
CWE-754CWE-823

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1008 Fallback Channels Command And Control
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
attack.mitre.org →
T1012 Query Registry Discovery
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-4695Same product: Mozilla Firefox
CVE-2026-4713Same product: Mozilla Firefox
CVE-2026-4714Same product: Mozilla Firefox
CVE-2024-6603Same product: Mozilla Firefox
CVE-2026-4708Same product: Mozilla Firefox
CVE-2026-4709Same product: Mozilla Firefox
CVE-2026-4706Same product: Mozilla Firefox
CVE-2024-1556Same product: Mozilla Firefox
CVE-2026-4707Same product: Mozilla Firefox
CVE-2026-4685Same product: Mozilla Firefox

Affected Assets

mozilla
firefox
≤ 115.34.0 · ≤ 149.0 · 128.0 — 140.9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V1.4.1

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation explicitly exercises unusual conditions to find missing or incorrect checks.

SI-10 Information Input Validation good match

Input validation directly requires checking for unexpected or malformed conditions before they propagate.

SA-15 Development Process, Standards, and Tools partial match

Requiring documented development standards and tools can mandate safe pointer usage and compiler/runtime checks that stop the weakness from being introduced.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles include structured handling of edge cases and exceptions during design.

SC-39 Process Isolation partial match

Process isolation confines damage from invalid pointer offsets to a single address space, reducing overall impact.

SI-16 Memory Protection partial match

Memory-protection controls limit the blast radius of an out-of-range pointer dereference without preventing or detecting the coding error itself.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.RA-01 partial match
blocks

SAST/DAST tools used for vulnerability identification can surface this class of coding defect.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require bounds-checked pointer arithmetic and static analysis to prevent out-of-range offsets.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.16 Identity management partial match
removes
A.8.15 Logging partial match
finds

Logging can record unhandled exceptions but does not prevent the weakness itself.

A.8.16 Monitoring activities partial match
finds

Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.

A.8.25 Secure development life cycle partial match
blocks

Secure development life cycle mandates exception handling and input validation that directly prevent missing checks for unusual conditions.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly call for handling of exceptional conditions and error paths.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates security-by-design principles (fail securely, least privilege, distrust external input, security-oriented design reviews) that reach some but not most CWE-754 cases; many exceptional-condition checks live in low-level code paths outside architecture-level engineering.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220726 Data Execution Prevention (DEP) must be configured to at least OptOut. blocks CWE-823

References