CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.
Other sources
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
— MITRE
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-4684
- CVE-2026-4685
- CVE-2026-4686
- CVE-2026-4687
- CVE-2026-4688
- CVE-2026-4689
- CVE-2026-4690
- CVE-2026-4691
- CVE-2026-4692
- CVE-2026-4693
- CVE-2026-4694
- CVE-2026-4695
- CVE-2026-4696
- CVE-2026-4697
- CVE-2026-4698
- CVE-2026-4699
- CVE-2026-4700
- CVE-2026-4701
- CVE-2026-4722
- CVE-2026-4702
- CVE-2026-4723
- CVE-2026-4724
- CVE-2026-4704
- CVE-2026-4705
- CVE-2026-4706
- CVE-2026-4707
- CVE-2026-4708
- CVE-2026-4709
- CVE-2026-4710
- CVE-2026-4711
- CVE-2026-4725
- CVE-2026-4712
- CVE-2026-4713
- CVE-2026-4714
- CVE-2026-4715
- CVE-2026-4716
- CVE-2026-4717
- CVE-2026-4726
- CVE-2025-59375
- CVE-2026-4727
- CVE-2026-4728
- CVE-2026-4718
- CVE-2026-4719
- CVE-2026-4720
- CVE-2026-4729
- CVE-2026-4721
- CVE-2026-3889
- CVE-2026-4371
Frequently Asked Questions
What is the severity of CVE-2026-4696?
CVE-2026-4696 has been classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2026-4696?
To fix CVE-2026-4696, update to Firefox version 149, Firefox ESR version 115.34 or 140.9, or Thunderbird version 149 or 140.9.
Which versions are affected by CVE-2026-4696?
CVE-2026-4696 affects Firefox versions less than 149, Firefox ESR versions less than 115.34 and 140.9, and Thunderbird versions less than 149 and 140.9.
What types of software are impacted by CVE-2026-4696?
CVE-2026-4696 impacts multiple versions of Firefox, Firefox ESR, and Thunderbird.
Is there any workaround for CVE-2026-4696?
There are no known workarounds for CVE-2026-4696; the recommended approach is to update to the patched versions.