There likely is an unpatched exploit that Mozilla is aware of but isn't disclosing (to the public). I'd hazard a guess it's more related to blindly parsing the

There likely is an unpatched exploit that Mozilla is aware of but isn't disclosing (to the public). I'd hazard a guess it's more related to blindly parsing the root store and trusting the certs that Mozilla has in there specifically for the purpose of not trusting them (DigiNotar, et. al).