The flaw stems from incorrect boundary checks in the NSS Libraries component used by Mozilla Firefox and Thunderbird. When malicious or malformed data is processed, the program may read beyond intended boundaries, corrupting adjacent memory. The CVE description does not explicitly indicate whether this leads to code execution or privilege escalation, but such memory corruption can create conditions for those effects depending on the execution context.

All Mozilla Firefox releases built before version 150 and the ESR branch 140.10, as well as all Mozilla Thunderbird releases built before version 150 and the ESR branch 140.10, are affected. Versions after those releases incorporate the NSS boundary condition fix and are not impacted.

The likely attack vector is the manipulation of data streams processed by NSS, such as crafted certificates, cryptographic messages, or malformed attachments. These inputs can trigger memory corruption, potentially leading to remote code execution if the attacker can exploit the corrupted state. No public exploit is known, and the EPSS score of 0.00032 (0.032%) indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 7.5 highlights high severity, warranting prompt mitigation.