CVE-2026-4720: Mozilla Firefox and Thunderbird memory safety bugs

CVE-2026-4720 · Severity: critical · CVSS 9.8 · Published 2026-03-24

Mozilla Firefox and Thunderbird are popular web browser and email applications used for internet browsing and communication. Multiple memory safety vulnerabilities were discovered that could allow an attacker to potentially take control of a user's computer or execute unauthorized commands. This could lead to the theft of sensitive personal data, unauthorized access to accounts, or the installation of malicious software.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla Thunderbird ESR. Vendors: Mozilla.

Quick answers

Is CVE-2026-4720 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4720 being exploited in the wild.
How severe is CVE-2026-4720?
Critical severity, with a CVSS score of 9.8, published 24 March 2026.
Which products and versions are affected?
Mozilla Firefox < 149; Mozilla Firefox ESR < 140.9; Mozilla Thunderbird < 149; Mozilla Thunderbird ESR < 140.9.
Is there a fix for CVE-2026-4720?
A patch was published on 2026-03-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4720 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4720?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Mozilla Firefox and Thunderbird are vulnerable to multiple memory safety bugs (including buffer overflows) that exhibit evidence of memory corruption. These vulnerabilities exist in Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird ESR versions prior to 140.9. An attacker could potentially exploit these flaws via the network to achieve arbitrary code execution in the context of the application. The root cause is identified as classic buffer overflows (CWE-120) and other memory management errors discovered through fuzzing. Patches are available in the latest releases of Firefox and Thunderbird.

Affected products

  • Mozilla Firefox < 149
  • Mozilla Firefox ESR < 140.9
  • Mozilla Thunderbird < 149
  • Mozilla Thunderbird ESR < 140.9

Timeline

  • 2026-03-24: disclosed
  • 2026-03-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.