high 8.8

CVE-2026-2781 json

Integer overflow in the Libraries component in NSS

published 2026-02-24 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-8502

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits: 0; none known

Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.

Patch / fix

fixed in 2 distros 7

mozilla firefox 140.8.0, 148.0
mozilla thunderbird 140.8.0, 148.0

debian ubuntu red hat suse opensuse almalinux rocky linux

nss Debian 12 2:3.87.1-1+deb12u2
nss Debian 13 2:3.110-1+deb13u1
nss Debian 14 2:3.121-1
firefox-esr Debian 12 140.8.0esr-1~deb12u1
firefox-esr Debian 13 140.8.0esr-1~deb13u1
firefox-esr Debian 14 140.8.0esr-1
thunderbird Debian 12 1:140.8.0esr-1~deb12u1
thunderbird Debian 13 1:140.8.0esr-1~deb13u1

debian advisories DEBIAN-CVE-2026-2781

nss Ubuntu 22.04 LTS 2:3.98-0ubuntu0.22.04.3
nss Ubuntu 24.04 LTS 2:3.98-1ubuntu0.1
nss Ubuntu 25.10 2:3.114-1ubuntu0.1
nss Ubuntu 26.04 LTS 2:3.120-1ubuntu1
nss Ubuntu Pro 14.04 LTS 2:3.28.4-0ubuntu0.14.04.5+esm13
nss Ubuntu Pro 16.04 LTS 2:3.28.4-0ubuntu0.16.04.14+esm5
nss Ubuntu Pro 18.04 LTS 2:3.35-2ubuntu2.16+esm1
nss Ubuntu Pro 20.04 LTS 2:3.98-0ubuntu0.20.04.2+esm1

ubuntu advisories UBUNTU-CVE-2026-2781

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

thunderbird RHEL 9 140.8.0-1.el9_7
thunderbird RHEL 10.1 140.8.0-2.el10_1
thunderbird RHEL 8 140.8.0-1.el8_10
firefox RHEL 10.1 140.8.0-2.el10_1
firefox RHEL 9 140.8.0-2.el9_7
firefox-x11 RHEL 9 140.8.0-2.el9_7
firefox RHEL 8 140.8.0-2.el8_10
thunderbird RHEL 8.2 AUS 140.8.0-1.el8_2

red hat advisories RHSA-2026:4432 RHSA-2026:4260 RHSA-2026:4152 RHSA-2026:4022 RHSA-2026:3976 RHSA-2026:3984

MozillaThunderbird SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 140.8.0-150200.8.260.1
MozillaFirefox SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 140.8.0-150200.152.222.1
mozilla-nss SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +12 more 3.112.3-150400.3.63.1
mozilla-nss SLE Micro 5.2 3.112.3-150000.3.135.1
mozilla-nss SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.112.3-58.136.1
MozillaFirefox SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 140.8.0-112.301.1

suse advisories SUSE-SU-2026:0880-1 SUSE-SU-2026:0871-1 SUSE-SU-2026:0814-1 SUSE-SU-2026:0813-1 SUSE-SU-2026:0812-1 SUSE-SU-2026:0740-1

MozillaThunderbird openSUSE Leap 16.0 140.8.1-bp160.1.1
MozillaFirefox openSUSE Leap 16.0 140.8.0-160000.1.1
MozillaFirefox openSUSE Tumbleweed 148.0-1.1
MozillaThunderbird openSUSE Tumbleweed 140.8.0-1.1
firefox-esr openSUSE Tumbleweed 140.8.0-1.1

opensuse advisories openSUSE-SU-2026:20391-1 openSUSE-SU-2026:20365-1 openSUSE-SU-2026:10257-1 openSUSE-SU-2026:10248-1 openSUSE-SU-2026:10242-1

thunderbird AlmaLinux 8 140.8.0-1.el8_10.alma.1
thunderbird AlmaLinux 9 140.8.0-1.el9_7.alma.1
thunderbird AlmaLinux 10 140.8.0-2.el10_1.alma.1
firefox AlmaLinux 8 140.8.0-2.el8_10.alma.1
firefox AlmaLinux 9 140.8.0-2.el9_7.alma.1
firefox-x11 AlmaLinux 9 140.8.0-2.el9_7.alma.1
firefox AlmaLinux 10 140.8.0-2.el10_1

almalinux advisories ALSA-2026:3515 ALSA-2026:3516 ALSA-2026:3517 ALSA-2026:3338 ALSA-2026:3339 ALSA-2026:3361

thunderbird Rocky Linux 10 140.8.0-2.el10_1
thunderbird Rocky Linux 9 140.8.0-1.el9_7
thunderbird Rocky Linux 8 140.8.0-1.el8_10
firefox Rocky Linux 10 140.8.0-2.el10_1
firefox Rocky Linux 9 140.8.0-2.el9_7
firefox Rocky Linux 8 140.8.0-2.el8_10

rocky linux advisories RLSA-2026:3517 RLSA-2026:3516 RLSA-2026:3515 RLSA-2026:3361 RLSA-2026:3339 RLSA-2026:3338

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2781 updated 2026-11-07 cvss 6.1

firefox: thunderbird: Integer overflow in the Libraries component in NSS

Red Hat Enterprise Linux 6 firefox, rhel10/thunderbird-flatpak Red Hat Enterprise Linux 7 rhel10/thunderbird-flatpak
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 10 rhel8/flatpak-runtime, rhel10/firefox-flatpak
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.8.0-2.el8_10, thunderbird 140.8.0-1.el8_10
fixed: vendor fix RHSA-2026:3338
Red Hat Enterprise Linux AppStream (v. 9) firefox 140.8.0-2.el9_7, firefox-x11 140.8.0-2.el9_7, thunderbird 140.8.0-1.el9_7
fixed: vendor fix RHSA-2026:3339
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.8.0-2.el10_1, thunderbird 140.8.0-2.el10_1
fixed: vendor fix RHSA-2026:3361
Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox 140.8.0-2.el8_2, thunderbird 140.8.0-1.el8_2
fixed: vendor fix RHSA-2026:3492
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.8.0-2.el8_4, thunderbird 140.8.0-2.el8_4
fixed: vendor fix RHSA-2026:3491
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.8.0-2.el8_6, thunderbird 140.8.0-1.el8_6 Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox 140.8.0-2.el8_6, thunderbird 140.8.0-1.el8_6
fixed: vendor fix RHSA-2026:3495

show 10 more

Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.8.0-2.el8_8, thunderbird 140.8.0-1.el8_8
fixed: vendor fix RHSA-2026:3494
Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox 140.8.0-2.el9_0, thunderbird 140.8.0-1.el9_0
fixed: vendor fix RHSA-2026:3493
Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.8.0-2.el9_2, firefox-x11 140.8.0-2.el9_2, thunderbird 140.8.0-1.el9_2
fixed: vendor fix RHSA-2026:4152
Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.8.0-2.el10_0, thunderbird 140.8.0-2.el10_0
fixed: vendor fix RHSA-2026:3976
Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox 140.8.0-2.el9_4, firefox-x11 140.8.0-2.el9_4, thunderbird 140.8.0-1.el9_4
fixed: vendor fix RHSA-2026:3496
Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.8.0-2.el9_6, firefox-x11 140.8.0-2.el9_6, thunderbird 140.8.0-1.el9_6
fixed: vendor fix RHSA-2026:3497
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.8.0-2.el8_4, thunderbird 140.8.0-2.el8_4
fixed: vendor fix RHSA-2026:3491
Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox 140.8.0-2.el8_6, thunderbird 140.8.0-1.el8_6
fixed: vendor fix RHSA-2026:3495
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.8.0-2.el8_8, thunderbird 140.8.0-1.el8_8
fixed: vendor fix RHSA-2026:3494
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.8.0-2.el7_9
fixed: vendor fix RHSA-2026:3984

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 8 mo ago (2026-02-26)

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Mozilla Firefox
Mozilla Thunderbird

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

References

mozilla.org /security/advisories/mfsa2026-13/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-15/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-16/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-17/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=2009552
issue-tracking, permissions-required
mozilla.org /security/advisories/mfsa2026-31/
lists.debian.org /debian-lts-announce/2026/03/msg00012.html

Sources

CVE List CVE-2026-2781
NVD CVE-2026-2781

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary