CVE-2026-12318: Incorrect boundary conditions in the Libraries component in NSS

Synopsis

An incorrect boundary condition vulnerability exists in the Network Security Services (NSS) Libraries component used by Mozilla Firefox and Mozilla Thunderbird. The flaw is reachable over the network without any authentication or user interaction, making it exploitable by any remote attacker who can reach an affected service. Successful exploitation gives an attacker limited read access, limited write access, and can partially disrupt service availability. A patched-image rebuild at Firefox and Thunderbird version 152 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials or account of any kind are needed to attempt exploitation.

• Victim interactionNot required

  The attacker does not need the victim to click a link, open a file, or take any other action.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental dependencies required.

Blast Radius

• A successful attacker reads a limited subset of data processed by NSS, which may include cryptographic material or connection metadata.
• A successful attacker writes or tampers with a limited subset of data handled by the NSS library, potentially influencing TLS session state or certificate processing.
• A successful attacker partially disrupts the availability of the affected application, degrading or interrupting its normal operation.