A Google vulnerability researcher named Tavis Ormandy has identified a critical vulnerability affecting Mozilla Network Security Services (NSS). NSS allows developers to create security-enabled applications with support for multiple communication security protocols like Secure Socket Layer (SSL) and Transport Layer Security (TLS). The vulnerability, tracked as CVE-2021-43527 (AKA “BigSig”), is described as a heap-based buffer overflow that’s caused when handling encrypted digital signatures in affected Mozilla email clients, and PDF viewers. If successfully exploited, this flaw can cause catastrophic program crashes, and allow the attacker to execute arbitrary code. This vulnerability affects all Mozilla versions released since October 2012, however the popular web browser Firefox is not an affected service. The vulnerability has been officially patched, and users are urged to update to NSS versions 3.68.1 and NSS 3.73.