This vulnerability, identified as CVE-2026-16389, is due to incorrect boundary conditions leading to an integer overflow within the Libraries component of NSS used by Mozilla Firefox. The issue could allow an attacker to cause significant impact on confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 153 and Thunderbird 153. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory explicitly lists this vulnerability among multiple high-impact fixes in Firefox 153 and Thunderbird 153.

Successful exploitation of this vulnerability could lead to complete compromise of confidentiality, integrity, and availability of the affected Firefox or Thunderbird application. The integer overflow and boundary condition errors in NSS libraries could be leveraged by an attacker to execute arbitrary code or cause denial of service. However, there are currently no known exploits in the wild.

Mozilla has released an official fix for this vulnerability in Firefox 153 and Thunderbird 153. Users and administrators should update affected products to version 153 or later to remediate this issue. No additional mitigation actions are required beyond applying the official update.