Bug 2450711 (CVE-2026-4721)

Summary:	CVE-2026-4721 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gotiwari, jgrulich, jhorak, mvyas, rhel-process-autobot, tpopela, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-24 13:01:46 UTC

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.

Comment 1 errata-xmlrpc 2026-03-26 11:21:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:5931 https://access.redhat.com/errata/RHSA-2026:5931

Comment 2 errata-xmlrpc 2026-03-26 11:31:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:5930 https://access.redhat.com/errata/RHSA-2026:5930

Comment 3 errata-xmlrpc 2026-03-26 11:33:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:5932 https://access.redhat.com/errata/RHSA-2026:5932

Comment 4 errata-xmlrpc 2026-03-30 15:58:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:6188 https://access.redhat.com/errata/RHSA-2026:6188

Comment 5 errata-xmlrpc 2026-04-01 09:36:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:6342 https://access.redhat.com/errata/RHSA-2026:6342

Comment 6 errata-xmlrpc 2026-04-07 21:29:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6917 https://access.redhat.com/errata/RHSA-2026:6917

Comment 7 errata-xmlrpc 2026-04-13 10:02:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:7839 https://access.redhat.com/errata/RHSA-2026:7839

Comment 8 errata-xmlrpc 2026-04-13 10:03:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:7840 https://access.redhat.com/errata/RHSA-2026:7840

Comment 9 errata-xmlrpc 2026-04-13 10:12:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:7841 https://access.redhat.com/errata/RHSA-2026:7841

Comment 10 errata-xmlrpc 2026-04-13 10:13:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:7842 https://access.redhat.com/errata/RHSA-2026:7842

Comment 11 errata-xmlrpc 2026-04-13 10:20:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:7843 https://access.redhat.com/errata/RHSA-2026:7843

Comment 12 errata-xmlrpc 2026-04-13 10:33:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:7838 https://access.redhat.com/errata/RHSA-2026:7838

Comment 13 errata-xmlrpc 2026-04-13 10:45:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:7845 https://access.redhat.com/errata/RHSA-2026:7845

Comment 14 errata-xmlrpc 2026-04-13 10:50:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:7837 https://access.redhat.com/errata/RHSA-2026:7837

Comment 15 errata-xmlrpc 2026-04-13 12:45:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:7858 https://access.redhat.com/errata/RHSA-2026:7858

Comment 16 errata-xmlrpc 2026-04-15 10:29:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:8285 https://access.redhat.com/errata/RHSA-2026:8285

Comment 17 errata-xmlrpc 2026-04-15 10:37:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:8287 https://access.redhat.com/errata/RHSA-2026:8287

Comment 18 errata-xmlrpc 2026-04-15 10:38:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:8288 https://access.redhat.com/errata/RHSA-2026:8288

Comment 19 errata-xmlrpc 2026-04-15 10:43:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:8286 https://access.redhat.com/errata/RHSA-2026:8286

Comment 20 errata-xmlrpc 2026-04-15 10:44:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:8289 https://access.redhat.com/errata/RHSA-2026:8289

Comment 21 errata-xmlrpc 2026-04-15 10:46:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:8284 https://access.redhat.com/errata/RHSA-2026:8284

Comment 22 errata-xmlrpc 2026-04-15 10:51:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:8290 https://access.redhat.com/errata/RHSA-2026:8290

Comment 23 errata-xmlrpc 2026-04-15 14:04:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:8315 https://access.redhat.com/errata/RHSA-2026:8315

Comment 24 errata-xmlrpc 2026-04-16 10:16:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:8427 https://access.redhat.com/errata/RHSA-2026:8427

Comment 25 errata-xmlrpc 2026-04-20 01:26:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:8850 https://access.redhat.com/errata/RHSA-2026:8850