This vulnerability arises from incorrect boundary checks in the Libraries component of the NSS toolkit, which can lead to memory corruption. The flaw aligns with CWE‑754 (boundary condition error) and CWE‑787 (buffer overread), indicating that misinterpreted size handling could corrupt or expose memory contents. Based on the description, it is inferred that exploiting the vulnerability would require manipulating NSS memory operations, which may be possible through local privilege escalation or exploitation of other components that interact with NSS.

Mozilla Firefox and Thunderbird builds that include the unpatched NSS library are affected. For Firefox, all versions before 150, and ESR releases prior to 115.35 and 140.10 are vulnerable. For Thunderbird, all versions before 150, and ESR releases before 115.35 and 140.10 are impacted.

The CVSS score of 7.5 indicates significant impact, while the EPSS score of less than 1% shows low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector likely involves local exploitation of NSS memory operations, possibly requiring privileged code or other components that interface with NSS. With no publicly reported exploits, the overall risk is moderate but high enough to warrant immediate remediation.