Every CVE Search/ Get API key

CVE-2026-12318

Incorrect boundary conditions in the Libraries component in NSS

7.3 HighFix available

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.26%Unchanged since Jun 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.3

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Record
CVE-2026-12318
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2026-37109 7.3

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Record
EUVD-2026-37109
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6q4q-pwxf-8h4v 7.3

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in...

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152.

Record
GHSA-6q4q-pwxf-8h4v
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 7.3

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Record
CVE-2026-12318
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
OSVDEBIAN-CVE-2026-12318 7.3

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Record
DEBIAN-CVE-2026-12318
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-3995 7.3

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. (CVE-2026-12318)

Record
OESA-2026-3995
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 8 moreShow less
OSVOESA-2026-3996 7.3

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. (CVE-2026-12318)

Record
OESA-2026-3996
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-3997 7.3

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. (CVE-2026-12318)

Record
OESA-2026-3997
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-3998 7.3

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. (CVE-2026-12318)

Record
OESA-2026-3998
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4103 7.3

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.(CVE-2026-12318)

Record
OESA-2026-4103
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-12318 7.3

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Record
UBUNTU-CVE-2026-12318
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:11052-1 No score

MozillaFirefox-152.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-152.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11052-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11373-1 No score

firefox-esr-153.0-1.1 on GA media

These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11373-1
Updated
2026-11-02
OSVUSN-8481-1 No score

nss vulnerability

Haruto Kimura discovered that NSS had incorrecty handled parsing PKCS#11 URI escape sequences. An attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service, or obtain sensitive information.

Record
USN-8481-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss
Debian:12
 before 2:3.87.1-1+deb12u3, plus listed versions
2:3.87.1-12:3.87.1-1+deb12u12:3.87.1-1+deb12u2
2:3.87.1-1+deb12u3
nss
Debian:13
 before 2:3.110-1+deb13u3, plus listed versions
2:3.110-12:3.110-1+deb13u12:3.110-1+deb13u2
2:3.110-1+deb13u3
nss
Debian:14
 before 2:3.124-1, plus listed versions
2:3.110-12:3.111-12:3.112-12:3.114-12:3.116-1
Show 6 moreShow less
2:3.117-12:3.119-12:3.120-12:3.121-12:3.123-12:3.123.1-1
2:3.124-1
nss
openEuler:20.03-LTS-SP4
 before 3.54.0-15.oe2003sp4
3.54.0-15.oe2003sp4
nss
openEuler:22.03-LTS-SP4
 before 3.72.0-13.oe2203sp4
3.72.0-13.oe2203sp4
nss
openEuler:24.03-LTS-SP1
 before 3.94.0-11.oe2403sp1
3.94.0-11.oe2403sp1
nss
openEuler:24.03-LTS-SP3
 before 3.94.0-11.oe2403sp3
3.94.0-11.oe2403sp3
nss
openEuler:24.03-LTS-SP4
 before 3.94.0-11.oe2403sp4
3.94.0-11.oe2403sp4
nss
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2:3.15.1-1ubuntu12:3.15.2-12:3.15.3-12:3.15.3.1-12:3.15.3.1-1.1
Show 37 moreShow less
2:3.15.3.1-1.1ubuntu12:3.15.4-1ubuntu32:3.15.4-1ubuntu42:3.15.4-1ubuntu52:3.15.4-1ubuntu62:3.15.4-1ubuntu72:3.15.4-1ubuntu7.12:3.17-0ubuntu0.14.04.12:3.17.1-0ubuntu0.14.04.12:3.17.1-0ubuntu0.14.04.22:3.17.4-0ubuntu0.14.04.12:3.19.2-0ubuntu0.14.04.12:3.19.2.1-0ubuntu0.14.04.12:3.19.2.1-0ubuntu0.14.04.22:3.21-0ubuntu0.14.04.12:3.21-0ubuntu0.14.04.22:3.23-0ubuntu0.14.04.12:3.26.2-0ubuntu0.14.04.32:3.28.4-0ubuntu0.14.04.12:3.28.4-0ubuntu0.14.04.22:3.28.4-0ubuntu0.14.04.32:3.28.4-0ubuntu0.14.04.42:3.28.4-0ubuntu0.14.04.52:3.28.4-0ubuntu0.14.04.5+esm12:3.28.4-0ubuntu0.14.04.5+esm22:3.28.4-0ubuntu0.14.04.5+esm32:3.28.4-0ubuntu0.14.04.5+esm42:3.28.4-0ubuntu0.14.04.5+esm52:3.28.4-0ubuntu0.14.04.5+esm62:3.28.4-0ubuntu0.14.04.5+esm72:3.28.4-0ubuntu0.14.04.5+esm82:3.28.4-0ubuntu0.14.04.5+esm92:3.28.4-0ubuntu0.14.04.5+esm102:3.28.4-0ubuntu0.14.04.5+esm112:3.28.4-0ubuntu0.14.04.5+esm122:3.28.4-0ubuntu0.14.04.5+esm132:3.28.4-0ubuntu0.14.04.5+esm14
 None known
nss
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:3.19.2-1ubuntu12:3.19.2.1-0ubuntu12:3.21-1ubuntu22:3.21-1ubuntu32:3.21-1ubuntu4
Show 21 moreShow less
2:3.23-0ubuntu0.16.04.12:3.26.2-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.12:3.28.4-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.32:3.28.4-0ubuntu0.16.04.42:3.28.4-0ubuntu0.16.04.52:3.28.4-0ubuntu0.16.04.62:3.28.4-0ubuntu0.16.04.82:3.28.4-0ubuntu0.16.04.92:3.28.4-0ubuntu0.16.04.102:3.28.4-0ubuntu0.16.04.112:3.28.4-0ubuntu0.16.04.122:3.28.4-0ubuntu0.16.04.132:3.28.4-0ubuntu0.16.04.142:3.28.4-0ubuntu0.16.04.14+esm12:3.28.4-0ubuntu0.16.04.14+esm22:3.28.4-0ubuntu0.16.04.14+esm32:3.28.4-0ubuntu0.16.04.14+esm42:3.28.4-0ubuntu0.16.04.14+esm52:3.28.4-0ubuntu0.16.04.14+esm6
 None known
Show 18 moreShow less
Affected packages
PackageAffectedFixed
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
nss
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:3.32-1ubuntu32:3.34-1ubuntu12:3.35-2ubuntu22:3.35-2ubuntu2.12:3.35-2ubuntu2.2
Show 14 moreShow less
2:3.35-2ubuntu2.32:3.35-2ubuntu2.52:3.35-2ubuntu2.62:3.35-2ubuntu2.72:3.35-2ubuntu2.82:3.35-2ubuntu2.92:3.35-2ubuntu2.112:3.35-2ubuntu2.122:3.35-2ubuntu2.132:3.35-2ubuntu2.142:3.35-2ubuntu2.152:3.35-2ubuntu2.162:3.35-2ubuntu2.16+esm12:3.35-2ubuntu2.16+esm2
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
nss
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:3.45-1ubuntu22:3.47-1ubuntu12:3.47-1ubuntu22:3.48-1ubuntu12:3.49.1-1ubuntu1
Show 12 moreShow less
2:3.49.1-1ubuntu1.12:3.49.1-1ubuntu1.22:3.49.1-1ubuntu1.42:3.49.1-1ubuntu1.52:3.49.1-1ubuntu1.62:3.49.1-1ubuntu1.72:3.49.1-1ubuntu1.82:3.49.1-1ubuntu1.92:3.98-0ubuntu0.20.04.12:3.98-0ubuntu0.20.04.22:3.98-0ubuntu0.20.04.2+esm12:3.98-0ubuntu0.20.04.2+esm2
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs102
Ubuntu:22.04:LTS
 All versions, plus listed versions
102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
mozjs91
Ubuntu:22.04:LTS
 All versions, plus listed versions
91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1
 None known
nss
Ubuntu:22.04:LTS
 before 2:3.98-0ubuntu0.22.04.4, plus listed versions
2:3.68-1ubuntu12:3.68-1ubuntu22:3.68.2-0ubuntu12:3.68.2-0ubuntu1.12:3.68.2-0ubuntu1.22:3.98-0ubuntu0.22.04.12:3.98-0ubuntu0.22.04.22:3.98-0ubuntu0.22.04.3
2:3.98-0ubuntu0.22.04.4
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
mozjs102
Ubuntu:24.04:LTS
 All versions, plus listed versions
102.15.1-1102.15.1-3ubuntu2
 None known
mozjs115
Ubuntu:24.04:LTS
 All versions, plus listed versions
115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4
Show 4 moreShow less
115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1
 None known
nss
Ubuntu:24.04:LTS
 before 2:3.98-1ubuntu0.2, plus listed versions
2:3.92-12:3.94-12:3.95-12:3.96.1-12:3.98-12:3.98-1build12:3.98-1ubuntu0.1
2:3.98-1ubuntu0.2
nss
Ubuntu:25.10
 before 2:3.114-1ubuntu0.2, plus listed versions
2:3.108-1ubuntu12:3.110-12:3.111-12:3.112-12:3.114-12:3.114-1ubuntu0.1
2:3.114-1ubuntu0.2
nss
Ubuntu:26.04:LTS
 before 2:3.120-1ubuntu2.1, plus listed versions
2:3.114-12:3.117-12:3.119-12:3.120-12:3.120-1ubuntu12:3.120-1ubuntu2
2:3.120-1ubuntu2.1
MozillaFirefox
openSUSE:Tumbleweed
 before 152.0-1.1
152.0-1.1
firefox-esr
openSUSE:Tumbleweed
 before 153.0-1.1
153.0-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-12318 is a high vulnerability (CVSS 7.3) in Mozilla Firefox, published June 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in nss 2:3.87.1-1+deb12u3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 70 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open