Red Hat CVE-2026-4724

Remote unauthenticated attacker can exploit Firefox versions below 149 by delivering malicious audio/video content over network. Victim must visit webpage or open file containing crafted multimedia. No special configuration required; affects default Firefox installations.

Risk assessment is constrained by the absence of CVSS vector, CVSS score, EPSS score, and KEV confirmation status. However, the classification as information disclosure and the fact that Mozilla assigned a dedicated security advisory (MFSA2026-20) suggest this warrants prioritized patching. The undefined behavior nature indicates potential memory corruption that, while reported as information disclosure, could escalate to remote code execution if the vulnerability can be chained with other flaws. Firefox's widespread deployment across consumer and enterprise environments means affected users number in the millions. The lack of a public POC and the undefined-behavior designation suggest this was patched before significant exploitation; however, organizations on extended release cycles should still treat this as moderate-to-high priority until Firefox 149+ is deployed.

An attacker hosts a malicious webpage containing crafted audio or video content (MP4, WebM, or similar codec streams) that triggers undefined behavior in Firefox's media decoding pipeline. When a user visits the page, the malicious media is parsed by the vulnerable Audio/Video component, causing out-of-bounds memory access or use-after-free. The attacker leverages this to read adjacent memory regions, potentially exfiltrating session tokens, cached credentials, or other sensitive data stored in the browser's heap. No public POC is known, but the vulnerability's assignment to a named Mozilla advisory suggests it was responsibly disclosed and patched before weaponization; however, unpatched Firefox installations remain at risk.