Cyber Resilience

CVE-2026-4715

Critical

Published: 24 March 2026

Published
24 March 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0043 34.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-4715 is a critical-severity Use of Uninitialized Resource (CWE-908) vulnerability in Mozilla Firefox. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Deeper analysis

CVE-2026-4715 is an uninitialized memory vulnerability (CWE-908) in the Graphics: Canvas2D component of Mozilla products. It affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9. The vulnerability was publicly disclosed on 2026-03-24 and carries a CVSS v3.1 base score of 9.1, indicating critical severity.

Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, no user interaction, and without changing the scope of impact. Successful exploitation enables high confidentiality and availability impacts, such as unauthorized disclosure of sensitive information from uninitialized memory or denial-of-service via crashes, without affecting integrity.

Mozilla security advisories (MFSA 2026-20, 22, 23, 24) and the associated Bugzilla entry (bug 2018405) detail the patch, recommending immediate updates to Firefox 149, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9 to mitigate the issue. No workarounds are specified in the provided references.

EU & UK References

Vulnerability details

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CWE(s)
CWE-908

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Uninitialized memory read in client-side Canvas2D rendering enables remote exploitation via malicious web content or email (Drive-by Compromise) and direct browser crashes for DoS (Application or System Exploitation).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4716Same product: Mozilla Firefox
CVE-2026-2794Same product: Mozilla Firefox
CVE-2024-3862Same product: Mozilla Firefox
CVE-2026-4707Same product: Mozilla Firefox
CVE-2026-4713Same product: Mozilla Firefox
CVE-2026-4709Same product: Mozilla Firefox
CVE-2026-4706Same product: Mozilla Firefox
CVE-2026-2806Same product: Mozilla Firefox
CVE-2026-4704Same product: Mozilla Firefox
CVE-2026-4686Same product: Mozilla Firefox

Affected Assets

mozilla
firefox
≤ 140.9.0 · ≤ 149.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Mandates timely patching of software flaws like the uninitialized memory vulnerability in Firefox Canvas2D to eliminate exploitability.

RA-5 Vulnerability Monitoring and Scanning partial match
preventdetect

Requires scanning for vulnerabilities such as CVE-2026-4715 in browser components and initiating remediation to affected systems.

SI-16 Memory Protection partial match
prevent

Provides memory protection mechanisms that mitigate unauthorized disclosure or crashes from uninitialized memory exploitation.

References