CVE-2026-6767: 
NixOS vulnerability analysis and mitigation

CVE-2026-6767 is a vulnerability classified as "Other issue" in the Libraries component of Mozilla's Network Security Services (NSS). It was reported by Haruto Kimura and disclosed on April 21, 2026, as part of Mozilla's coordinated security release. The vulnerability affects Firefox prior to version 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150, and Thunderbird ESR prior to 140.10. It carries a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability is rooted in improper restriction of operations within the bounds of a memory buffer (CWE-119) and use of a potentially dangerous function (CWE-676) within Mozilla's NSS library. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, meaning a remote unauthenticated attacker could trigger the issue. The specific nature of the flaw is described only as an "Other issue" in NSS, and the underlying Mozilla bug report (Bug 2023209) is access-restricted, limiting public technical detail. The vulnerability is related to buffer handling in the NSS cryptographic library used by Firefox and Thunderbird (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-32).

Successful exploitation of CVE-2026-6767 results in a limited confidentiality impact — specifically, low-level information disclosure — with no assessed impact to integrity or availability. The vulnerability affects the NSS cryptographic library shared across Firefox and Thunderbird, meaning any user running an unpatched version of these applications could be exposed to potential data leakage via network-accessible attack paths. The scope is limited to the affected application and does not indicate lateral movement potential or privilege escalation on its own (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6767. The EPSS score is approximately 0.034%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified in connection with this CVE (Feedly).

Mozilla has released patched versions addressing CVE-2026-6767: Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should update to these versions or later as soon as possible. No configuration-based workarounds have been published; upgrading is the only recommended remediation. Downstream Linux distributions including Red Hat, Debian, SUSE, Oracle Linux, Rocky Linux, AlmaLinux, and Amazon Linux have also released updated packages (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability was part of a large batch of security fixes released by Mozilla on April 21, 2026, covering Firefox 150 and associated ESR releases. Security news outlets including GBHackers, CyberPress, and CyberNoz covered the Firefox 150 release broadly, noting multiple code execution and moderate-severity fixes. The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products could allow for arbitrary code execution, though CVE-2026-6767 itself is rated moderate. No notable individual researcher commentary specific to this CVE has been identified (CIS Advisory).