CVE-2026-2781
Published: 24 February 2026
Summary
CVE-2026-2781 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 17.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates identification, reporting, and timely patching of flaws like the integer overflow in NSS, directly preventing remote code execution in affected Mozilla products.
SI-16 implements memory protections such as ASLR and DEP to mitigate exploitation of the integer overflow leading to RCE.
RA-5 requires vulnerability scanning to identify systems running vulnerable versions of Firefox, Thunderbird, or NSS affected by CVE-2026-2781.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in NSS enables unauthenticated remote code execution in client applications (Firefox/Thunderbird) over the network with no user interaction, directly mapping to drive-by compromise and client-side exploitation for code execution.
NVD Description
Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
Deeper analysisAI
CVE-2026-2781 is an integer overflow vulnerability (CWE-190) in the Libraries component of NSS (Network Security Services). It affects Mozilla products including Firefox versions prior to 148, Firefox ESR prior to 140.8 and 115.35, Thunderbird prior to 148 and 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its potential for high impact on confidentiality, integrity, and availability.
A remote attacker requires no privileges or user interaction and can exploit the vulnerability over the network with low complexity. Successful exploitation could allow the attacker to achieve high-impact effects, including unauthorized access to sensitive data, modification of system resources, and disruption of service, potentially leading to full remote code execution on affected systems.
Mozilla security advisories (MFSA 2026-13, 15, 16, 17) and the associated Bugzilla entry detail the fix applied in the specified versions of Firefox, Firefox ESR, and Thunderbird. Users should update to these patched releases to mitigate the issue.
Details
- CWE(s)