CVE-2026-4717

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-4717 is a privilege escalation vulnerability in the Netmonitor component affecting Mozilla Firefox prior to version 149, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird prior to 140.9. The issue has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, and no requirements for privileges or user interaction.

Remote attackers require no authentication or privileges to exploit this vulnerability over the network. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing attackers to escalate privileges within affected applications and potentially gain unauthorized control over the victim's system.

Mozilla security advisories (MFSA 2026-20, 22, 23, and 24) and the associated Bugzilla entry detail the fix applied in the specified versions. Security practitioners should prioritize updating to Firefox 149, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9 to mitigate the vulnerability.