CVE-2026-2781 Integer overflow in the Libraries component in NSS
An integer overflow in the NSS libraries allows attackers to potentially execute arbitrary code or cause a denial of service in Firefox and Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-2781?
CVE-2026-2781 is a high-severity vulnerability in Mozilla Firefox, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
Weakness: CWE-190
Which versions are affected by CVE-2026-2781?
It affects 2 products.
Linux distribution packages (18)
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.2 | All versions | 3.112.3-150000.3.135.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.3 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.4 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.5 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 3.112.3-58.136.1 |
mozilla-nss SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.112.3-58.136.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 3.112.3-150400.3.63.1 |
mozilla-nss openSUSE:Leap 15.6 | All versions | 3.112.3-150400.3.63.1 |
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2026-2781?
Upgrade to a fixed version.
Is CVE-2026-2781 being exploited?
There is no known exploitation of CVE-2026-2781 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as BELL-CVE-2026-2781, DEBIAN-CVE-2026-2781, DLA-4508-1, DSA-6149-1, ECHO-c6c4-6d91-e895, GHSA-q6rm-rhj9-jpg5 and 5 more.