Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was
    fixed in Firefox 153 and Thunderbird 153. (CVE-2026-16389)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787115646 advisory.

  - Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox     143 and Thunderbird 143. (CVE-2025-10530)

  - Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143     and Thunderbird 143. (CVE-2025-10531)

  - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained     with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for     macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138,     Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10. (CVE-2025-4082)

  - A specially crafted filename containing a large number of encoded newline characters could obscure the     file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android.
    Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and     Thunderbird 138. (CVE-2025-4086)

  - Due to insufficient escaping of special characters in the copy as cURL feature, an attacker could trick     a user into using this command, potentially leading to local code execution on the user's system. This     vulnerability was fixed in Firefox 138 and Thunderbird 138. (CVE-2025-4089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104807 advisory.

    Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was     fixed in Firefox 153 and Thunderbird 153.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nss package has been released.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4729 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4729-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     August 10, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nss     Version        : 3.61-1+deb11u7 2:3.87.1-1+deb12u4     CVE ID         : CVE-2026-16389

    Tomoya Nakanishi discovered a flaw in nss, the Mozilla Network Security     Service library, which may result in execution of arbitrary code if a     specially crafted certificate is processed.

    For Debian 11 bullseye, this problem has been fixed in version     3.61-1+deb11u7.

    For Debian 12 bookworm, this problem has been fixed in version     2:3.87.1-1+deb12u4.

    We recommend that you upgrade your nss packages.

    For the detailed security status of nss please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nss

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6403 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6403-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 29, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nss     CVE ID         : CVE-2026-16389

    Tomoya Nakanishi discovered a flaw in nss, the Mozilla Network Security     Service library, which may result in execution of arbitrary code if a     specially crafted certificate is processed.

    For the stable distribution (trixie), this problem has been fixed in     version 2:3.110-1+deb13u4.

    We recommend that you upgrade your nss packages.

    For the detailed security status of nss please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/nss

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6dab7a3eff advisory.

    - Update to latest upstream (153.0)

    ----

    - New upstream release (153.0)

    ----

    - Updated to latest upstream (153.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was     fixed in Firefox 153 and Thunderbird 153. (CVE-2026-16389)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d71f89d7e advisory.

    - Update to latest upstream (153.0)

    ----

    - New upstream release (153.0)

    ----

    - Updated to latest upstream (153.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-71 advisory.

  - Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2026-16360, CVE-2026-16412)

  - Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was     fixed in Firefox 153 and Thunderbird 153. (CVE-2026-16367)

  - The code to parse MIME headers for display when forwarding a message (if the setting to view all headers     was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer     for the headers, and potentially crashing Thunderbird. (CVE-2026-14899)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 153.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-71 advisory.

  - Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2026-16360, CVE-2026-16412)

  - Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was     fixed in Firefox 153 and Thunderbird 153. (CVE-2026-16367)

  - The code to parse MIME headers for display when forwarding a message (if the setting to view all headers     was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer     for the headers, and potentially crashing Thunderbird. (CVE-2026-14899)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 153.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-68 advisory.

  - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-16412)

  - Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was     fixed in Firefox 153 and Thunderbird 153. (CVE-2026-16367)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

  - Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox     ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 153.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-68 advisory.

  - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-16412)

  - Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was     fixed in Firefox 153 and Thunderbird 153. (CVE-2026-16367)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

  - Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox     ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
464953	Echo: nss: security update to 2:3.126-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
464953	Echo: nss: security update to 2:3.126-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
360063	AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787115646)	Nessus	Alma Linux Local Security Checks	Local	medium
348282	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2026:4268-1)	Nessus	SuSE Local Security Checks	Local	critical
346212	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2026:4156-1)	Nessus	SuSE Local Security Checks	Local	critical
342669	openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21713-1)	Nessus	SuSE Local Security Checks	Local	critical
340879	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nss (UTSA-2026-104807)	Nessus	Unity Linux Local Security Checks	Local	critical
338661	Photon OS 5.0: Nss PHSA-2026-5.0-92-0965	Nessus	PhotonOS Local Security Checks	Local	critical
334146	Debian dla-4729 : libnss3 - security update	Nessus	Debian Local Security Checks	Local	critical
330685	Debian dsa-6403 : libnss3 - security update	Nessus	Debian Local Security Checks	Local	critical
329998	Fedora 43 : firefox (2026-6dab7a3eff)	Nessus	Fedora Local Security Checks	Local	critical
329443	Linux Distros Unpatched Vulnerability : CVE-2026-16389	Nessus	Misc.	Local	critical
329269	Fedora 44 : firefox (2026-7d71f89d7e)	Nessus	Fedora Local Security Checks	Local	critical
329090	Mozilla Thunderbird < 153.0	Nessus	MacOS X Local Security Checks	Local	critical
329088	Mozilla Thunderbird < 153.0	Nessus	Windows	Local	critical
328774	Mozilla Firefox < 153.0	Nessus	MacOS X Local Security Checks	Local	critical
328773	Mozilla Firefox < 153.0	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2026-16389

critical

Tenable Plugins

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical