CVE-2026-4696
Critical · CVSS 9.8Mozilla Firefox / Thunderbird — Use-after-free in Layout: Text and Fonts
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-416, CWE-416, CWE-825
Description
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Search profile — drives PoC discovery
Symbols Layout: Text and FontsCWE-416CWE-825bugzilla.mozilla.org/show_bug.cgi?id=2020190mfsa2026-20mfsa2026-21mfsa2026-22mfsa2026-23
Keywords CVE-2026-4696Firefox use-after-freeThunderbird use-after-freeLayout Text Fonts UAFFirefox 149 exploitFirefox ESR 115.34Firefox ESR 140.9Thunderbird 149Thunderbird 140.9mfsa2026-20bug 2020190 Mozilla
Versions: Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, Thunderbird < 140.9
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2020190
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/errata/RHSA-2026:5930
- https://access.redhat.com/errata/RHSA-2026:5931
- https://access.redhat.com/errata/RHSA-2026:5932
- https://access.redhat.com/errata/RHSA-2026:6188
- https://access.redhat.com/errata/RHSA-2026:6342
- https://access.redhat.com/errata/RHSA-2026:6917
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T12:30:14.000Z