The vulnerability arises from incorrect boundary conditions within the NSS Libraries component of Mozilla Firefox. The flaw can corrupt memory when processing certain inputs, potentially leading to undefined behavior or other security consequences. The official description does not explicitly state that this could result in code execution or privilege escalation, so the exact impact remains uncertain.

All Mozilla Firefox releases prior to version 150 and Firefox ESR 140.10, as well as all Mozilla Thunderbird releases prior to version 150 and Thunderbird ESR 140.10, are affected.

Exploitation most likely involves malicious content or data handled by the browser, implying a remote attack vector from web pages or other user-supplied inputs. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but given the central role of NSS in cryptographic operations, the risk is high. The CVSS score of 7.5 indicates a high severity vulnerability. The absence of a known public exploit means the attack may still rely on crafted inputs, but the potential severity warrants immediate action.