CVE-2026-12318

Incorrect boundary conditions in the Libraries component in NSS

View on CVE.org
Published Jun 16, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Description
Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Analysis

AI-generated

Technical impact

Incorrect boundary conditions in the Libraries component of the Network Security Services (NSS) stack can cause a buffer overflow, which may result in memory corruption. This weakness corresponds to CWE‑119 and CWE‑787 and can compromise confidentiality, integrity, or availability of the affected system.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected, specifically all releases prior to version 152. Versions 152 and later include the fix.

Risk and Exploitability

The CVSS v3.1 score of 7.3 indicates a high severity level. EPSS shows a probability of exploitation of less than 1%. It is not listed in the CISA KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Mozilla Firefox 152 or newer.
  • Upgrade to Mozilla Thunderbird 152 or newer.
  • Monitor system logs for abnormal NSS activity after applying the updates.

Generated by OpenCVE AI on June 25, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4694-1 nss security update
Ubuntu USN Ubuntu USN USN-8481-1 NSS vulnerability
History
Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152. Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
References
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox
Type Values Removed Values Added
Description Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152.
Title Incorrect boundary conditions in the Libraries component in NSS
References
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Jun 16, 2026, 6:07 PM
Reserved
Jun 15, 2026, 3:08 PM

View source JSON

Updated
Jun 16, 2026, 6:04 PM

JSON

Status
Analyzed
Published
Jun 16, 2026, 1:16 PM
Modified
Oct 26, 2026, 12:10 PM

View source JSON

Severity
Low
Public date
Jun 16, 2026, 11:52 AM

View source Bugzilla JSON

Updated
Jun 25, 2026, 2:00 PM

JSON