CVE-2026-12318: High-Severity Boundary Condition Flaw in NSS Libraries Affecting Firefox and Thunderbird

Technical summary

CVE-2026-12318 stems from incorrect boundary condition handling in NSS Libraries, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw permits out-of-bounds memory access when processing network protocol data. Attackers can craft malicious input that bypasses buffer size checks, resulting in read or write operations beyond allocated memory regions. The vulnerability affects the cryptographic and TLS stacks integrated into Firefox 151 and Thunderbird 151 and earlier versions.

Business impact

Organizations relying on Firefox or Thunderbird for secure communications face exposure to confidentiality and integrity risks. The vulnerability permits information disclosure (reading uninitialized or adjacent memory), potential code execution through memory corruption, and denial of service via application crashes. For enterprises using Thunderbird as their email client, this affects the security of encrypted email handling and certificate validation. Firefox users on systems where the browser handles sensitive authentication tokens or credentials could see those tokens exposed.

Affected systems

Mozilla Firefox versions prior to 152 and Mozilla Thunderbird versions prior to 152 are vulnerable. The NSS Libraries component is the root cause, so any application embedding or linking against vulnerable NSS versions may be affected. Desktop and mobile platforms running these browsers are in scope. Server-side NSS deployments (such as those used in TLS termination or certificate validation services) should also be inventoried.

Exploitability

The vulnerability has a CVSS score of 7.3 (HIGH) with a network attack vector, low complexity, and no authentication requirement. Exploitation does not require user interaction. An attacker can craft a malicious network message or serve a specially crafted webpage to trigger the boundary condition. The flaw is exploitable remotely by any unauthenticated actor. However, the vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been publicly documented at publication time.

Remediation

Update Firefox to version 152 or later and Thunderbird to version 152 or later. Both updates include patches that enforce correct boundary condition checks in NSS Libraries. Users should prioritize this update, as the network attack surface and absence of user interaction requirements make this a critical availability and confidentiality concern. Verify patch deployment across all managed Firefox and Thunderbird installations within 7–14 days.

Patch guidance

Patches are available in Firefox 152 and Thunderbird 152 official releases. Organizations using managed deployment tools (Firefox ESR, Thunderbird ESR) should check Mozilla's security advisory for ESR update timelines. Automated update mechanisms in both applications can be configured to apply patches immediately or on a scheduled basis. Test patches in a non-production environment first to confirm compatibility with corporate email policies, extensions, and integrations. For Thunderbird, verify that email accounts and offline storage remain intact post-update.

Detection guidance

Monitor for Firefox and Thunderbird process crashes, especially those involving TLS/SSL handshakes or network I/O. Watch for unexpected memory access violations in browser or mail client logs. Network-based detection is challenging without deep packet inspection into TLS traffic; focus on identifying outdated browser versions through endpoint management tools or vulnerability scanning. Log authentication failures or unusual certificate validation errors that may indicate memory corruption. Correlate browser crashes with network requests from untrusted sources or recently visited websites.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity score, network attack vector, and lack of authentication barriers. The boundary condition flaw in cryptographic libraries directly undermines the confidentiality and integrity guarantees of encrypted communications. While not yet observed in active exploitation campaigns, the ease of triggering the flaw makes it an attractive target for sophisticated threat actors. Rapid patching within 1–2 weeks is strongly recommended, especially for organizations handling sensitive data or communications.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a network-reachable vulnerability (AV:N) with low attack complexity (AC:L), no privilege or user interaction requirements (PR:N/UI:N), and impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) in the scope of the vulnerable component only (S:U). The boundary condition flaw in NSS—a core cryptographic library—elevates the score into the HIGH band. The lack of KEV listing suggests the vulnerability is not yet weaponized at scale, but the technical characteristics make exploitation straightforward.

Frequently asked questions