Paper/Archive/CVE-2026-16389

CVE-2026-16389

Mozilla Firefox — Incorrect boundary conditions, integer overflow in the Libraries component in NSS

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

40

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 50.7.507 × 2010.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Affected

ProductAffectedFixed inSource

Firefoxsee advisory153CNA

Thunderbirdsee advisory153CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2043887 refmozilla.org/security/advisories/mfsa2026-68 refmozilla.org/security/advisories/mfsa2026-71 reflists.debian.org/debian-lts-announce/2026/08/msg00019.html