CVE-2026-2781: 
NixOS vulnerability analysis and mitigation

CVE-2026-2781 is an integer overflow vulnerability in the Libraries component of Mozilla's Network Security Services (NSS) library, specifically affecting the AES-GCM GHASH length computation. The flaw causes AES-GCM to produce incorrect authentication tags for data payloads of 512 MB or larger due to a 32-bit integer overflow in the gcmHash_Update function. It was discovered by Clay Ver Valen and disclosed on February 24, 2026. Affected products include Firefox < 148, Firefox ESR < 140.8, Firefox ESR < 115.35, Thunderbird < 148, and Thunderbird ESR < 140.8. Mozilla rated this vulnerability as moderate impact; the CVSS v3.1 base score assigned by NVD is 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Mozilla Bugzilla).

The root cause is CWE-190 (Integer Overflow or Wraparound) in security/nss/lib/freebl/gcm.c. The gcmHash_Update function accepts a len parameter typed as unsigned int (32-bit). When computing the GHASH length block, the expression ghash->cLen += (len * PR_BITS_PER_BYTE) performs 32-bit arithmetic before widening to 64-bit, causing the bit-length to wrap to zero at exactly 512 MB (2^32 bits). Per NIST SP 800-38D, the GHASH length block must encode lengths as 64-bit big-endian integers; the overflow causes NSS to use len(a) mod 2^32 || len(c) mod 2^32 instead, introducing ambiguity in the GHASH polynomial. This primarily affects ARM64 builds, as Intel and PPC builds use a different GHASH implementation. The fix is to cast len to uint64_t before multiplication: ghash->cLen += ((uint64_t)len * PR_BITS_PER_BYTE). A security implication identified by Mozilla engineer John Schanck is that the reduced-length encoding allows an attacker who observes a GCM ciphertext with AAD that is a multiple of 16 bytes and ciphertext > 512 MB to construct a second valid ciphertext (a forgery), violating the INT-CTXT property of the AEAD scheme (Mozilla Bugzilla).

The primary impact is a cryptographic integrity failure: AES-GCM authentication tags computed by affected NSS versions are incorrect for data ≥ 512 MB, breaking interoperability with all standards-compliant AES-GCM implementations (Chrome, OpenSSL, Java, Node.js). More critically, the overflow introduces an AEAD forgery vulnerability — an attacker who can observe a qualifying ciphertext can construct a second ciphertext that passes authentication without knowledge of the key, violating confidentiality and integrity guarantees. Applications relying on WebCrypto AES-GCM for large file encryption (e.g., web-based file sharing or messaging platforms) are forced to either skip MAC verification for large files or block large uploads, effectively defeating the authentication guarantee of AES-GCM. Data encrypted by pre-fix ARM64 Firefox builds (≥ 512 MB) cannot be correctly verified by patched builds or other implementations, creating a data accessibility risk (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation of the forgery aspect requires an attacker to observe a qualifying GCM ciphertext (AAD aligned to 16 bytes, ciphertext > 512 MB), which limits practical attack surface. No threat actor attribution has been reported (Mozilla Bugzilla).

1. Identify target application: Find a web application using Firefox's WebCrypto API (crypto.subtle.encrypt/decrypt with AES-GCM) to encrypt files ≥ 512 MB, where the attacker can observe ciphertexts and their associated data (AAD).
2. Obtain a qualifying ciphertext: Intercept or obtain a GCM ciphertext (iv, a, c, tag) where a (AAD) is a multiple of 16 bytes in length and c (ciphertext) is more than 512 MB.
3. Compute the forged ciphertext: Split c into c0 || c1 where c0 is a multiple of 512 MB. Construct a new ciphertext (iv, a || c0, c1, tag) — the same tag is valid for this new (AAD, ciphertext) pair due to the length-mod-2^32 ambiguity in the GHASH computation.
4. Submit forged ciphertext: Present the forged ciphertext to a vulnerable NSS-based decryption endpoint. The authentication tag will pass verification on unpatched ARM64 Firefox/NSS builds, achieving an AEAD forgery without knowledge of the encryption key.
5. Observe decrypted output: The decrypted plaintext will correspond to c1 (a suffix of the original plaintext), potentially exposing partial plaintext or bypassing integrity checks in the target application (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability in the following versions: Firefox 148, Firefox ESR 140.8, Firefox ESR 115.35, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately update all Firefox and Thunderbird installations to these minimum versions. No configuration-based workaround is available; upgrading is the only remediation. For applications that stored AES-GCM ciphertexts encrypted by pre-fix ARM64 Firefox builds with data ≥ 512 MB, Mozilla has provided sample JavaScript code to compute the corrected tag using GHASH field arithmetic, enabling backward-compatible decryption of legacy files. Administrators should use vulnerability scanners (Qualys, Nessus) to identify unpatched instances across their environment (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Mozilla Bugzilla).

The vulnerability was reported externally by Clay Ver Valen, a Technical Leader at Cisco on the Webex team, who noted significant real-world impact for enterprise applications handling large file uploads via WebCrypto AES-GCM. Mozilla engineer John Schanck initially characterized the issue as a correctness/interoperability problem but later identified the AEAD forgery security implication, leading to a sec-moderate classification and a security bug bounty award. The Tor Browser team (Giorgio Maone) requested the bug remain hidden until Firefox ESR 115 reached end-of-life to protect Tor Browser 13.5 Legacy users. Downstream Linux distributions (Debian, SUSE, Red Hat, Rocky Linux, AlmaLinux, Ubuntu, Slackware) and cloud providers (AWS) issued their own security advisories and package updates following the Mozilla disclosure (Mozilla Bugzilla).