CVE-2019-11719: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger...

Security readout for executives and security teams

This flaw is in Mozilla’s Network Security Services library as used by Firefox, Firefox ESR, and Thunderbird. A specially formed Curve25519 private key in PKCS#8 format could cause an out-of-bounds read, creating a possible information disclosure risk. The provided sources do not report active exploitation. Exposure is most likely on endpoints or systems running affected Mozilla products, or operating system packages carrying vulnerable NSS builds. Risk depends on whether users or applications import attacker-controlled PKCS#8 Curve25519 private keys. Address through normal vulnerability remediation unless affected systems process untrusted private keys. The main business concern is possible data disclosure from widely deployed browser and mail components, not confirmed active exploitation. Mitigation focus: Upgrade Firefox to 68 or later where still applicable.; Upgrade Firefox ESR to 60.8 or later where still applicable.; Upgrade Thunderbird to 60.8 or later where still applicable..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.