# RHSA-2026:5930: Security update for 2 packages RHSA-2026:5930, released April 15, 2026, fixes 37 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/rhsa-2026-5930 - Platform: Linux - Released: Apr 15, 2026 - Priority: High (Closes CVE-2026-4696, high severity) - CVEs: 37, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://access.redhat.com/errata/RHSA-2026:5930 ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | RHEL 9 | 0:140.9.0-1.el9_7 | | [firefox-x11](https://patchblox.com/security/data/product/linux/firefox-x11.md) | RHEL 9 | 0:140.9.0-1.el9_7 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-4696](https://patchblox.com/security/data/cve/CVE-2026-4696.md) | High | Use-after-free in the Layout: Text and Fonts component | 9.8 | 0.0097 | | | [CVE-2026-4700](https://patchblox.com/security/data/cve/CVE-2026-4700.md) | High | Mitigation bypass in the Networking: HTTP component | 9.8 | 0.0092 | | | [CVE-2026-4690](https://patchblox.com/security/data/cve/CVE-2026-4690.md) | High | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component | 8.6 | 0.0080 | | | [CVE-2026-4694](https://patchblox.com/security/data/cve/CVE-2026-4694.md) | High | Incorrect boundary conditions, integer overflow in the Graphics component | 8.2 | 0.0080 | | | [CVE-2026-4698](https://patchblox.com/security/data/cve/CVE-2026-4698.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0079 | | | [CVE-2026-4686](https://patchblox.com/security/data/cve/CVE-2026-4686.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0073 | | | [CVE-2026-4685](https://patchblox.com/security/data/cve/CVE-2026-4685.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0071 | | | [CVE-2026-4693](https://patchblox.com/security/data/cve/CVE-2026-4693.md) | High | Incorrect boundary conditions in the Audio/Video: Playback component | 8.2 | 0.0071 | | | [CVE-2026-4695](https://patchblox.com/security/data/cve/CVE-2026-4695.md) | High | Incorrect boundary conditions in the Audio/Video: Web Codecs component | 8.2 | 0.0071 | | | [CVE-2026-4697](https://patchblox.com/security/data/cve/CVE-2026-4697.md) | High | Incorrect boundary conditions in the Audio/Video: Web Codecs component | 8.2 | 0.0071 | | | [CVE-2026-4699](https://patchblox.com/security/data/cve/CVE-2026-4699.md) | High | Incorrect boundary conditions in the Layout: Text and Fonts component | 8.2 | 0.0071 | | | [CVE-2026-4702](https://patchblox.com/security/data/cve/CVE-2026-4702.md) | High | JIT miscompilation in the JavaScript Engine component | 9.8 | 0.0070 | | | [CVE-2026-4689](https://patchblox.com/security/data/cve/CVE-2026-4689.md) | High | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component | 10.0 | 0.0069 | | | [CVE-2026-4705](https://patchblox.com/security/data/cve/CVE-2026-4705.md) | High | Undefined behavior in the WebRTC: Signaling component | 9.8 | 0.0066 | | | [CVE-2026-4704](https://patchblox.com/security/data/cve/CVE-2026-4704.md) | High | Denial-of-service in the WebRTC: Signaling component | 8.2 | 0.0065 | | | [CVE-2026-4707](https://patchblox.com/security/data/cve/CVE-2026-4707.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0060 | | | [CVE-2026-4687](https://patchblox.com/security/data/cve/CVE-2026-4687.md) | High | Sandbox escape due to incorrect boundary conditions in the Telemetry component | 8.6 | 0.0056 | | | [CVE-2026-4688](https://patchblox.com/security/data/cve/CVE-2026-4688.md) | High | Sandbox escape due to use-after-free in the Disability Access APIs component | 10.0 | 0.0055 | | | [CVE-2026-4692](https://patchblox.com/security/data/cve/CVE-2026-4692.md) | High | Sandbox escape in the Responsive Design Mode component | 10.0 | 0.0051 | | | [CVE-2026-4691](https://patchblox.com/security/data/cve/CVE-2026-4691.md) | High | Use-after-free in the CSS Parsing and Computation component | 9.8 | 0.0050 | | | [CVE-2026-4709](https://patchblox.com/security/data/cve/CVE-2026-4709.md) | High | Incorrect boundary conditions in the Audio/Video: GMP component | 8.2 | 0.0048 | | | [CVE-2026-4718](https://patchblox.com/security/data/cve/CVE-2026-4718.md) | High | Undefined behavior in the WebRTC: Signaling component | 8.2 | 0.0048 | | | [CVE-2026-4701](https://patchblox.com/security/data/cve/CVE-2026-4701.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0048 | | | [CVE-2026-4706](https://patchblox.com/security/data/cve/CVE-2026-4706.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0047 | | | [CVE-2026-4708](https://patchblox.com/security/data/cve/CVE-2026-4708.md) | High | Incorrect boundary conditions in the Graphics component | 8.2 | 0.0045 | | | [CVE-2026-4713](https://patchblox.com/security/data/cve/CVE-2026-4713.md) | High | Incorrect boundary conditions in the Graphics component | 8.2 | 0.0045 | | | [CVE-2026-4714](https://patchblox.com/security/data/cve/CVE-2026-4714.md) | High | Incorrect boundary conditions in the Audio/Video component | 8.2 | 0.0045 | | | [CVE-2026-4719](https://patchblox.com/security/data/cve/CVE-2026-4719.md) | High | Incorrect boundary conditions in the Graphics: Text component | 8.2 | 0.0045 | | | [CVE-2026-4715](https://patchblox.com/security/data/cve/CVE-2026-4715.md) | High | Uninitialized memory in the Graphics: Canvas2D component | 9.1 | 0.0045 | | | [CVE-2026-4720](https://patchblox.com/security/data/cve/CVE-2026-4720.md) | High | Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 | 9.8 | 0.0044 | | | [CVE-2026-4721](https://patchblox.com/security/data/cve/CVE-2026-4721.md) | High | Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 | 9.8 | 0.0044 | | | [CVE-2026-4717](https://patchblox.com/security/data/cve/CVE-2026-4717.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0043 | | | [CVE-2026-4710](https://patchblox.com/security/data/cve/CVE-2026-4710.md) | High | Incorrect boundary conditions in the Audio/Video component | 9.8 | 0.0043 | | | [CVE-2026-4716](https://patchblox.com/security/data/cve/CVE-2026-4716.md) | High | Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component | 9.1 | 0.0042 | | | [CVE-2026-4711](https://patchblox.com/security/data/cve/CVE-2026-4711.md) | High | Use-after-free in the Widget: Cocoa component | 9.8 | 0.0041 | | | [CVE-2026-4712](https://patchblox.com/security/data/cve/CVE-2026-4712.md) | High | Information disclosure in the Widget: Cocoa component | 8.2 | 0.0040 | | | [CVE-2026-4684](https://patchblox.com/security/data/cve/CVE-2026-4684.md) | High | Race condition, use-after-free in the Graphics: WebRender component | 8.2 | 0.0037 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo