Vulnerability details

CVE-2026-4696

Red Hat Enterprise Linux 10

Use-after-free in the Layout: Text and Fonts component

CVSS 3.1

7.5High

Official description

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
7.5High	3.1	CVEProject cvelistV5 (CNA) (redhat-SADP)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Red Hat	Red Hat Enterprise Linux 10	All	CVEProject cvelistV5 (CNA)
Red Hat	Red Hat Enterprise Linux 10	All	CVEProject cvelistV5 (CNA)

References and advisories

https://access.redhat.com/errata/RHSA-2026:5930 vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=2020190
https://www.mozilla.org/security/advisories/mfsa2026-20/
https://www.mozilla.org/security/advisories/mfsa2026-21/
https://www.mozilla.org/security/advisories/mfsa2026-22/
https://www.mozilla.org/security/advisories/mfsa2026-23/
https://www.mozilla.org/security/advisories/mfsa2026-24/
https://access.redhat.com/security/cve/CVE-2026-4696 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2450740 issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4696.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:8427 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7843 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8315 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5931 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6342 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5932 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6917 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7840 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8285 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7858 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8850 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7842 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8289 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7838 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8288 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7839 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8286 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7841 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8287 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7845 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8290 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7837 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8284 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6188 vendor-advisoryx_refsource_REDHAT

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-24
Last updated: 2026-07-15
State: Published
Assigner (CNA): mozilla

Exploit prediction (EPSS)

0.96%

Probability of exploitation in 30 days

61.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference