CVE-2026-6772

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published
Apr 21, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-67737.5Denial-of-service due to integer overflow in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 150 and Thunderbird 150CVE-2026-67745.4Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67755.3Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67767.8Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, ThunderbCVE-2026-67775.3Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67785.3Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67795.3Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67807.5Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67817.5Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-67827.5Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-678229.8Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDseCVE-2026-678279.8Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE)
CVE-2026-6772: High severity, CVSS 7.5 | Vulnix