CVE-2026-2781: Integer overflow in the Libraries component in NSS
Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148 and Firefox ESR < 140.8.
Other sources
Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 148 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.35 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.28.4-0ubuntu0.14.04.5+esm13 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.28.4-0ubuntu0.16.04.14+esm5 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.35-2ubuntu2.16+esm1 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.98-0ubuntu0.20.04.2+esm1 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.98-0ubuntu0.22.04.3 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.98-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.114-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/nssto a version that resolves this vulnerability.Fixed in 2:3.120-1ubuntu1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 148 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.8 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.35 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 148 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-2757
- CVE-2026-2758
- CVE-2026-2759
- CVE-2026-2795
- CVE-2026-2760
- CVE-2026-2761
- CVE-2026-2762
- CVE-2026-2763
- CVE-2026-2764
- CVE-2026-2796
- CVE-2026-2797
- CVE-2026-2765
- CVE-2026-2766
- CVE-2026-2767
- CVE-2026-2768
- CVE-2026-2798
- CVE-2026-2769
- CVE-2026-2799
- CVE-2026-2770
- CVE-2026-2771
- CVE-2026-2772
- CVE-2026-2773
- CVE-2026-2774
- CVE-2026-2775
- CVE-2026-2776
- CVE-2026-2777
- CVE-2026-2778
- CVE-2026-2779
- CVE-2026-2800
- CVE-2026-2780
- CVE-2026-2781
- CVE-2026-2801
- CVE-2026-2782
- CVE-2026-2783
- CVE-2026-2802
- CVE-2026-2803
- CVE-2026-2784
- CVE-2026-2785
- CVE-2026-2804
- CVE-2026-2786
- CVE-2026-2805
- CVE-2026-2787
- CVE-2026-2788
- CVE-2026-2789
- CVE-2026-2806
- CVE-2026-2790
- CVE-2026-2791
- CVE-2026-2807
- CVE-2026-2792
- CVE-2026-2793
- CVE-2026-6746
- CVE-2026-6749
- CVE-2026-6750
- CVE-2026-6752
- CVE-2026-6754
- CVE-2026-6762
- CVE-2026-6767
- CVE-2026-6772
- CVE-2026-6785
- CVE-2026-2794
Frequently Asked Questions
What is the severity of CVE-2026-2781?
CVE-2026-2781 has a critical severity rating of 9.8.
How do I fix CVE-2026-2781?
To fix CVE-2026-2781, update to Firefox version 148, Firefox ESR version 140.8, Thunderbird version 148, or Thunderbird version 140.8.
Which software is affected by CVE-2026-2781?
CVE-2026-2781 affects Mozilla Firefox versions prior to 148, Firefox ESR versions prior to 140.8, and Mozilla Thunderbird versions prior to 148.
What type of vulnerability is CVE-2026-2781?
CVE-2026-2781 is classified as an integer overflow vulnerability.
When was CVE-2026-2781 published?
CVE-2026-2781 was published on February 24, 2026.