CVE-2026-4720
Published: 24 March 2026
Summary
CVE-2026-4720 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 34.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4720 consists of multiple memory safety bugs, classified under CWE-120, present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148. Some of these bugs exhibited evidence of memory corruption, which Mozilla presumes could be exploited to run arbitrary code with sufficient effort. The vulnerability was published on 2026-03-24 and carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and without changing scope (S:U). Successful exploitation could result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), enabling potential arbitrary code execution on affected systems.
Mozilla advisories MFSA2026-20, MFSA2026-22, MFSA2026-23, and MFSA2026-24 detail the issues, with fixes available in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Additional technical information is provided in Bugzilla entries for bugs 2004652, 2019372, 2021922, 2022567, and 2022733.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14855
Vulnerability details
Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
more
run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption RCE (CWE-120) in client applications (Firefox/Thunderbird) with no auth/UI required directly enables drive-by compromise via malicious web/email content and exploitation for client execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires organizations to identify, report, and correct system flaws like the memory safety bugs in CVE-2026-4720 through timely patching to updated versions such as Firefox 149.
SI-16 implements memory protection mechanisms such as non-executable memory and address space randomization to prevent unauthorized code execution from memory corruption exploits in CVE-2026-4720.
RA-5 mandates vulnerability scanning to detect systems running vulnerable Firefox ESR 140.8 or Thunderbird ESR 140.8 affected by CVE-2026-4720's memory safety bugs.