Mozilla Firefox and Thunderbird GMP Component Denial-of-Service Vulnerability (CVE-2026-4709)

CVE-2026-4709 describes a vulnerability affecting Mozilla Firefox and Thunderbird related to incorrect boundary conditions in the Graphics Media Player (GMP) component's audio/video processing. Specifically, Firefox versions prior to 149, Firefox ESR versions prior to 115.34 and 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9 are affected. Successful exploitation of this vulnerability could lead to a denial-of-service condition. This vulnerability was disclosed on March 24, 2026, and defenders should ensure their Firefox and Thunderbird installations are updated to the latest versions to mitigate the risk.

Attack Chain

1. An attacker crafts a malicious audio/video file or stream.
2. The user opens the crafted file or visits a website embedding it via Firefox or Thunderbird.
3. The GMP component attempts to process the audio/video data.
4. The incorrect boundary conditions within the GMP component are triggered due to the malformed data.
5. This leads to a memory corruption or other unexpected behavior within the GMP component.
6. The application (Firefox or Thunderbird) becomes unstable.
7. The application crashes, resulting in a denial of service.

Impact

Successful exploitation of CVE-2026-4709 can result in a denial-of-service condition. While the NVD entry assigns a CVSS score of 7.5 (High), the impact is limited to the availability of the affected application. Users would experience unexpected crashes and be unable to use the browser or email client until it is restarted. Widespread exploitation could impact productivity and potentially disrupt workflows relying on Firefox or Thunderbird.

Recommendation

• Upgrade all Firefox installations to version 149 or later to remediate CVE-2026-4709.
• Upgrade all Firefox ESR installations to version 115.34 or 140.9 or later to remediate CVE-2026-4709.
• Upgrade all Thunderbird installations to version 149 or later to remediate CVE-2026-4709.
• Monitor process crashes of Firefox and Thunderbird with unexpected module faults to identify potential exploitation attempts.