CVE-2026-6767
Published: 21 April 2026
Summary
CVE-2026-6767 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 13.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-6767 is an unspecified issue in the Libraries component of Network Security Services (NSS), a cryptographic library used by Mozilla products. The vulnerability, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), affects Firefox versions prior to 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150 and 140.10. It received a CVSS v3.1 base score of 5.3, indicating medium severity with network accessibility, low attack complexity, no privileges or user interaction required, and unchanged scope.
An unauthenticated attacker on the network can exploit this vulnerability remotely with low complexity and no user interaction. Successful exploitation allows limited disclosure of confidential information, such as potentially sensitive data processed by NSS, but does not impact integrity or availability.
Mozilla security advisories (MFSA 2026-30 through 2026-33) and the associated Bugzilla entry confirm the issue was addressed in the listed fixed releases. Security practitioners should prioritize updating affected Firefox and Thunderbird installations to the patched versions to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24108
Vulnerability details
Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote memory buffer flaw in NSS enables unauthenticated network-based confidentiality attacks that directly disclose sensitive local data processed by the library (e.g., crypto material).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the identified NSS flaw via application of the vendor patches released in Firefox/Thunderbird 150 and ESR 115.35/140.10.
Enforces configuration settings that mandate only approved, patched versions of NSS-dependent applications are installed and running.
Requires vulnerability scanning to discover unpatched Firefox/Thunderbird instances containing the vulnerable NSS library before exploitation occurs.