Denial of service vulnerability exists in the Libraries component of the Network Security Services (NSS) library used by Mozilla Firefox and Thunderbird. The flaw falls under uncontrolled resource consumption (CWE‑400) and uncontrolled allocation beyond limits (CWE‑770). An attacker could trigger the vulnerable library to exhaust system resources or crash the application, leading to denial of service for legitimate users.

The vulnerability affects all released versions of Mozilla Firefox and Thunderbird prior to version 149. Users running older builds are exposed, while Mozilla has addressed the issue in Firefox 149 and Thunderbird 149. Vendors and users should verify the installed version; only releases 149 and newer provide the fix.

With a CVSS score of 7.5, the severity is high, yet the EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The exact attack vector is not documented in the advisory; based on the description, it is inferred that an attacker would need to deliver data that exercises the NSS Libraries component, though whether this occurs remotely or locally is unclear. The primary consequence remains a denial of service to the impacted application.