VDB
CVE-2026-4729
CVE-2026-4729
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.
EPSS 0.02% · 6.7th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.02%
6.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mozilla | thunderbird | 0 |
| Mozilla | Firefox | 149 |
| mozilla | firefox | 0 |
| Mozilla | Thunderbird | 149 |
Exploit Intelligence
- CIRCL seen: CVE-2026-4729 (circl-sighting)
- CIRCL seen: CVE-2026-4729 (circl-sighting)
- Memory safety bugs fixed in Firefox 149 and Thunderbird 149 (circl)
- https://www.mozilla.org/security/advisories/mfsa2026-20/ (circl)
- https://www.mozilla.org/security/advisories/mfsa2026-23/ (circl)
- mfsa2026-23.yml (github-poc)
- mfsa2026-23.yml (github-poc)
- mfsa2026-23.yml (github-poc)
- mfsa2026-23.yml (github-poc)
- 2026.xml (github-poc)
…and 3 more exploits
Timeline
- Mar 24, 2026 CVE Published
- Mar 25, 2026 EPSS Score
- Mar 25, 2026 Coalition ESS Score
- Mar 25, 2026 PoC Published
- Mar 26, 2026 EPSS Score
- Mar 27, 2026 Coalition ESS Score
- Mar 29, 2026 PoC Published
- Apr 13, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
References
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-24/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-23/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-22/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-21/ advisory
- Memory safety bugs fixed in Firefox 149 and Thunderbird 149 url
- https://www.mozilla.org/security/advisories/mfsa2026-20/ url
- https://www.mozilla.org/security/advisories/mfsa2026-23/ url
- https://nvd.nist.gov/vuln/detail/CVE-2026-4729 advisory
- https://www.mozilla.org/security/advisories/mfsa2026-20 url
- https://www.mozilla.org/security/advisories/mfsa2026-23 url