Description
Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An invalid pointer in Mozilla’s Security: PSM component can corrupt memory addresses when the component processes requests. The misuse of the pointer may allow an attacker to overwrite critical data in memory, potentially leading to arbitrary code execution or denial of service. The flaw triggers a NULL pointer dereference (CWE‑476) and an invalid pointer reference (CWE‑824).

Affected Systems

Mozilla Firefox and Mozilla Thunderbird versions prior to 153 are affected. Versions 152 and earlier of both applications contain the flaw, while version 153 and later incorporate the fix.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5 and an EPSS score of less than 1%, indicating that exploitation opportunities are currently rare. It is not listed in the CISA KEV catalog and no public exploit has been reported. The CVE does not specify the exact attack vector or prerequisites, so the conditions required for exploitation remain unspecified.

Generated by OpenCVE AI on August 3, 2026 at 00:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Firefox and Thunderbird to any release 153 or later.
  • Apply all subsequent Mozilla security patches as they become available.
  • Continually monitor Mozilla security advisories for further updates.

Generated by OpenCVE AI on August 3, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153. Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
References

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-824
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153.
Title Invalid pointer in the Security: PSM component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-23T14:55:53.803Z

Reserved: 2026-07-20T21:57:50.095Z

Link: CVE-2026-16409

cve-icon Vulnrichment

Updated: 2026-07-22T18:03:19.431Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T13:17:16.330

Modified: 2026-07-24T16:45:54.423

Link: CVE-2026-16409

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-21T12:38:20Z

Links: CVE-2026-16409 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T00:45:03Z

Weaknesses
  • CWE-476

    NULL Pointer Dereference

  • CWE-824

    Access of Uninitialized Pointer