CVE-2026-2781 describes an integer overflow vulnerability in the NSS Libraries component within Mozilla Firefox. Integer overflow can lead to memory corruption or other unintended behavior, potentially allowing an attacker to impact confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Mozilla fixed this issue in Firefox 148 and Firefox ESR 140.8, as documented in their official security advisories MFSA 2026-13 and MFSA 2026-15.

Successful exploitation of this integer overflow vulnerability could result in significant impact to confidentiality, integrity, and availability of the affected Firefox browser. The CVSS vector indicates remote attackers can exploit this over the network with low complexity and no privileges, but user interaction is required. The vulnerability could potentially allow execution of arbitrary code or other malicious actions due to memory corruption. However, no known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update their Firefox installations to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official update. Patch status is confirmed by Mozilla advisories MFSA 2026-13 and MFSA 2026-15.