CVE-2026-2781

CRITICAL

Firefox and Thunderbird < 148 and < 140.8 - Integer Overflow in NSS Libraries

Title source: llm
STIX 2.1

Description

Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.

References (7)

Core 7

Scores

CVSS v3 9.8
EPSS 0.0036
EPSS Percentile 27.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-190
Status published
Products (13)
mozilla/firefox < 140.8.0
mozilla/firefox < 148.0
Mozilla/Firefox 115.35 - 115.*
Mozilla/Firefox 140.8 - 140.*
Mozilla/Firefox 148
Mozilla/Firefox unspecified - 148
Mozilla/Firefox ESR unspecified - 140.8
mozilla/thunderbird < 140.8.0
mozilla/thunderbird < 148.0
Mozilla/Thunderbird 140.8 - 140.*
... and 3 more
Published Feb 24, 2026
Tracked Since Feb 24, 2026