## Summary
CVE-2026-4695 is a high-severity vulnerability in Mozilla’s Audio/Video: Web Codecs component caused by incorrect boundary conditions. It was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
## Technical Details
- Component: Audio/Video: Web Codecs
- Root issue class: Incorrect boundary conditions (CWE-754)
- The Bugzilla entry for Bug 2020030 (labeled CVE-2026-4695) includes patches and a repro artifact:
- A test patch referencing CDEF and int16_t overflow with large frame sizes (e.g., CDEF-int16_t-overflow-with-large-frame)
- A fix patch referencing CDEF search for frames and int16_t overflow (e.g., Fix-int16_t-overflow-in-CDEF-search-for-frames-32768)
- A repro HTML file is present in the bug: repro_cdef_min.html.
## Affected
- Mozilla Firefox versions: mozilla firefox < 140.9.0 (as provided)
- Fixed in: Firefox 149, Firefox ESR 140.9, Thunderbird 149, Thunderbird 140.9 (per NVD description)
## Impact
- CVSS indicates Availability impact (A:H) with network reachability (AV:N) and no required privileges (PR:N).
- Mozilla advisory classifies the issue as Impact: high.
## Mitigation
1. Upgrade to the fixed releases: Firefox 149 or Firefox ESR 140.9 (and Thunderbird 149 / Thunderbird 140.9 where applicable).
2. If immediate upgrade isn’t possible, restrict exposure to untrusted web content that may trigger Web Codecs parsing paths.
3. Monitor for crash/instability patterns associated with Audio/Video: Web Codecs activity in affected browser versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-754