CVE-2026-12318

EUVD-2026-37109
Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mozillaCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 18.16%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
mozillafirefox
𝑥
< 152.0.0
CNA
mozillathunderbird
𝑥
< 152.0.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
158.0.1-1
fixed
nss
bookworm
vulnerable
bookworm (security)
2:3.87.1-1+deb12u4
fixed
forky
2:3.131-1
fixed
sid
2:3.131.1-1
fixed
trixie
2:3.110-1+deb13u4
fixed
trixie (security)
2:3.110-1+deb13u4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
thunderbird
jammy
needed
noble
not-affected
questing
not-affected
resolute
not-affected
mozjs38
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
mozjs52
bionic
ignored
focal
ignored
jammy
dne
noble
dne
questing
dne
resolute
dne
mozjs68
focal
ignored
jammy
dne
noble
dne
questing
dne
resolute
dne
mozjs78
jammy
ignored
noble
dne
questing
dne
resolute
dne
mozjs91
jammy
ignored
noble
dne
questing
dne
resolute
dne
mozjs102
jammy
ignored
noble
ignored
questing
dne
resolute
dne
mozjs115
jammy
dne
noble
ignored
questing
dne
resolute
dne
nss
bionic
needs-triage
focal
needs-triage
jammy
Fixed 2:3.98-0ubuntu0.22.04.4
released
noble
Fixed 2:3.98-1ubuntu0.2
released
questing
Fixed 2:3.114-1ubuntu0.2
released
resolute
Fixed 2:3.120-1ubuntu2.1
released
trusty
needs-triage
xenial
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
nspr
Amazon Linux 2023
0:4.39.0-1.amzn2023.0.2
fixed
nspr-debuginfo
Amazon Linux 2023
0:4.39.0-1.amzn2023.0.2
fixed
nspr-devel
Amazon Linux 2023
0:4.39.0-1.amzn2023.0.2
fixed
nss
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-debuginfo
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-debugsource
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-devel
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-pkcs11-devel
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-softokn
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-softokn-debuginfo
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-softokn-devel
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-softokn-freebl
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-softokn-freebl-debuginfo
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-softokn-freebl-devel
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-sysinit
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-sysinit-debuginfo
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-tools
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-tools-debuginfo
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-util
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-util-debuginfo
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
nss-util-devel
Amazon Linux 2023
0:3.124.0-1.amzn2023.0.2
fixed
Common Weakness Enumeration
References
https://bugzilla.mozilla.org/show_bug.cgi?id=2023478
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-60/