An integer overflow exists in the Libraries component of NSS, which can corrupt memory or lead to unintended behavior. This weakness is classified as CWE‑190, indicating that improper handling of arithmetic operations may allow an attacker to influence program flow or data. The description does not confirm a remote code execution, but the high severity suggests that successful exploitation could compromise integrity or allow privilege escalation within the affected application or system. The vulnerability has been fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.

Mozilla Firefox versions prior to 148 and Firefox ESR 140.8, as well as Mozilla Thunderbird versions prior to 148 and Thunderbird ESR 140.8, all use the vulnerable NSS library. Updated releases contain the fix and are therefore unaffected.

The CVSS score of 8.8 classifies the issue as high severity, yet the EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that attackers would need to deliver malicious data that triggers the overflow via the affected NSS component, which is likely to occur in a client‑side scenario such as browsing or email processing. Because the impact can be severe if exploited, vigilance is warranted despite the low exploitation probability.