Undefined Behavior in Firefox Audio/Video Component (CVE-2026-4724)
CVE-2026-4724 Published on March 24, 2026
Undefined behavior in the Audio/Video component
Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Vulnerability Analysis
CVE-2026-4724 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
The software uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity. This can lead to resultant weaknesses when the required properties change, such as when the software is ported to a different platform or if an interaction error (CWE-435) occurs.
Products Associated with CVE-2026-4724
stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.
Affected Versions
Mozilla Firefox:- Version 149, <= * is unaffected.
- Version 149, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.