high 7.5

CVE-2026-4708 json

Incorrect boundary conditions in the Graphics component

published 2026-03-24 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-14831

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Patch / fix

fixed in 1 distros 6

mozilla firefox 140.9.0, 149.0

debian red hat suse opensuse almalinux rocky linux

firefox-esr Debian 12 140.9.0esr-1~deb12u1
firefox-esr Debian 13 140.9.0esr-1~deb13u1
firefox-esr Debian 14 140.9.0esr-1
thunderbird Debian 12 1:140.9.0esr-1~deb12u1
thunderbird Debian 13 1:140.9.0esr-1~deb13u1
thunderbird Debian 14 1:140.9.0esr-1

debian advisories DEBIAN-CVE-2026-4708

thunderbird RHEL 8 140.9.0-1.el8_10
thunderbird RHEL 10.1 140.9.0-1.el10_1
thunderbird RHEL 9 140.9.0-1.el9_7
firefox RHEL 10.1 140.9.0-1.el10_1
firefox RHEL 8 140.9.0-1.el8_10
firefox RHEL 9 140.9.0-1.el9_7
firefox-x11 RHEL 9 140.9.0-1.el9_7
thunderbird RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 140.9.0-1.el8_4

red hat advisories RHSA-2026:8850 RHSA-2026:8427 RHSA-2026:8315 RHSA-2026:8289 RHSA-2026:8290 RHSA-2026:8287

MozillaThunderbird openSUSE Leap 15.6 140.9.0-150200.8.263.1
MozillaFirefox SLES for SAP applications 16.0, SLES 16.0 140.9.0-160000.1.1
MozillaFirefox SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 140.9.0-150200.152.225.1
MozillaFirefox SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 140.9.0-112.304.2

suse advisories SUSE-SU-2026:1163-1 SUSE-SU-2026:20978-1 SUSE-SU-2026:1127-1 SUSE-SU-2026:1126-1

MozillaFirefox openSUSE Tumbleweed 149.0-1.1
MozillaThunderbird openSUSE Tumbleweed 140.9.0-1.1
MozillaFirefox openSUSE Leap 16.0 140.9.0-160000.1.1
firefox-esr openSUSE Tumbleweed 140.9.0-1.1

opensuse advisories openSUSE-SU-2026:10458-1 openSUSE-SU-2026:10447-1 openSUSE-SU-2026:20439-1 openSUSE-SU-2026:10413-1

thunderbird AlmaLinux 8 140.9.0-1.el8_10.alma.1
thunderbird AlmaLinux 10 140.9.0-1.el10_1.alma.1
thunderbird AlmaLinux 9 140.9.0-1.el9_7.alma.1
firefox AlmaLinux 9 140.9.0-1.el9_7.alma.1
firefox-x11 AlmaLinux 9 140.9.0-1.el9_7.alma.1
firefox AlmaLinux 10 140.9.0-1.el10_1
firefox AlmaLinux 8 140.9.0-1.el8_10.alma.1

almalinux advisories ALSA-2026:6917 ALSA-2026:6342 ALSA-2026:6188 ALSA-2026:5930 ALSA-2026:5931 ALSA-2026:5932

thunderbird Rocky Linux 8 140.9.0-1.el8_10
firefox Rocky Linux 10 140.9.0-1.el10_1
thunderbird Rocky Linux 10 140.9.0-1.el10_1
firefox Rocky Linux 9 140.9.0-1.el9_7
thunderbird Rocky Linux 9 140.9.0-1.el9_7
firefox Rocky Linux 8 140.9.0-1.el8_10

rocky linux advisories RLSA-2026:6917 RLSA-2026:5931 RLSA-2026:6342 RLSA-2026:5930 RLSA-2026:6188 RLSA-2026:5932

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4708 updated 2026-11-05 cvss 6.1

firefox: thunderbird: Incorrect boundary conditions in the Graphics component

Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 10 rhel10/firefox-flatpak, rhel10/thunderbird-flatpak
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.9.0-1.el8_10, thunderbird 140.9.0-1.el8_10
fixed: vendor fix RHSA-2026:5932
Red Hat Enterprise Linux AppStream (v. 9) firefox 140.9.0-1.el9_7, firefox-x11 140.9.0-1.el9_7, thunderbird 140.9.0-1.el9_7
fixed: vendor fix RHSA-2026:5930
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.9.0-1.el10_1, thunderbird 140.9.0-1.el10_1
fixed: vendor fix RHSA-2026:5931
Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox 140.9.0-1.el8_2, thunderbird 140.9.0-1.el8_2
fixed: vendor fix RHSA-2026:7840
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.9.0-1.el8_4, thunderbird 140.9.0-1.el8_4
fixed: vendor fix RHSA-2026:7858
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.9.0-1.el8_6, thunderbird 140.9.0-1.el8_6 Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox 140.9.0-1.el8_6, thunderbird 140.9.0-1.el8_6
fixed: vendor fix RHSA-2026:7842

show 10 more

Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.9.0-1.el8_8, thunderbird 140.9.0-1.el8_8
fixed: vendor fix RHSA-2026:7838
Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox 140.9.0-1.el9_0, thunderbird 140.9.0-1.el9_0
fixed: vendor fix RHSA-2026:7839
Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.9.0-1.el9_2, firefox-x11 140.9.0-1.el9_2, thunderbird 140.9.0-1.el9_2
fixed: vendor fix RHSA-2026:7841
Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.9.0-1.el10_0, thunderbird 140.9.0-1.el10_0
fixed: vendor fix RHSA-2026:7843
Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox 140.9.0-1.el9_4, firefox-x11 140.9.0-1.el9_4, thunderbird 140.9.0-1.el9_4
fixed: vendor fix RHSA-2026:7845
Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.9.0-1.el9_6, firefox-x11 140.9.0-1.el9_6, thunderbird 140.9.0-1.el9_6
fixed: vendor fix RHSA-2026:7837
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.9.0-1.el8_4, thunderbird 140.9.0-1.el8_4
fixed: vendor fix RHSA-2026:7858
Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox 140.9.0-1.el8_6, thunderbird 140.9.0-1.el8_6
fixed: vendor fix RHSA-2026:7842
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.9.0-1.el8_8, thunderbird 140.9.0-1.el8_8
fixed: vendor fix RHSA-2026:7838
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.9.0-1.el7_9
fixed: vendor fix RHSA-2026:8427

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 7 mo ago (2026-03-25)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Mozilla Firefox
Mozilla Thunderbird

Classification

Weakness

CWE-754 Improper Check for Unusual or Exceptional Conditions

References

mozilla.org /security/advisories/mfsa2026-20/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-22/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=2015268
permissions-required
mozilla.org /security/advisories/mfsa2026-23/
mozilla.org /security/advisories/mfsa2026-24/

Sources

CVE List CVE-2026-4708
NVD CVE-2026-4708

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary