CVE-2026-12291

Use-after-free in the Networking: HTTP component

View on CVE.org
Published Jun 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Analysis

AI-generated

Technical impact

The flaw is a use‑after‑free bug in the Networking: HTTP component. The flaw can be triggered by malicious network traffic that results in a dangling pointer dereference, allowing an attacker to execute arbitrary code in the context of the vulnerable application.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. Versions earlier than Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12 contain the vulnerability; all later releases contain the patch.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity, while the EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely through crafted HTTP traffic without requiring authentication, making systems exposed to untrusted network data at high risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Mozilla Firefox 152 or newer, or to the latest Firefox ESR 140.12 or 115.37 release.
  • Upgrade to Mozilla Thunderbird 152 or newer, or to the latest Thunderbird ESR 140.12 release.
  • If an immediate upgrade is not possible, isolate the affected applications from untrusted network connections or limit external HTTP traffic until the update can be applied.

Generated by OpenCVE AI on June 18, 2026 at 22:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4635-1 firefox-esr security update
Debian DLA Debian DLA DLA-4636-1 thunderbird security update
Debian DSA Debian DSA DSA-6350-1 firefox-esr security update
Debian DSA Debian DSA DSA-6351-1 thunderbird security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:27717 cve-icon
https://access.redhat.com/errata/RHSA-2026:27733 cve-icon
https://access.redhat.com/errata/RHSA-2026:27734 cve-icon
https://access.redhat.com/errata/RHSA-2026:29940 cve-icon
https://access.redhat.com/errata/RHSA-2026:30846 cve-icon
https://access.redhat.com/errata/RHSA-2026:33445 cve-icon
https://access.redhat.com/errata/RHSA-2026:36100 cve-icon
https://access.redhat.com/errata/RHSA-2026:36101 cve-icon
https://access.redhat.com/errata/RHSA-2026:36102 cve-icon
https://access.redhat.com/errata/RHSA-2026:36103 cve-icon
https://access.redhat.com/errata/RHSA-2026:37210 cve-icon
https://access.redhat.com/errata/RHSA-2026:37391 cve-icon
https://access.redhat.com/errata/RHSA-2026:38506 cve-icon
https://access.redhat.com/errata/RHSA-2026:38750 cve-icon
https://access.redhat.com/errata/RHSA-2026:38751 cve-icon
https://access.redhat.com/errata/RHSA-2026:38753 cve-icon
https://access.redhat.com/errata/RHSA-2026:39011 cve-icon
https://access.redhat.com/errata/RHSA-2026:39141 cve-icon
https://access.redhat.com/errata/RHSA-2026:39142 cve-icon
https://access.redhat.com/errata/RHSA-2026:39428 cve-icon
https://access.redhat.com/errata/RHSA-2026:39706 cve-icon
https://access.redhat.com/security/cve/CVE-2026-12291 cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=2036929 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2489244 cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-12291 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12291.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-12291 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-57/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-58/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12291 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-59/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-60/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-61/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12291 cve-icon
History
Type Values Removed Values Added
Weaknesses CWE‑416
Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important
Type Values Removed Values Added
Weaknesses CWE‑416
Type Values Removed Values Added
Description Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
References
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox
Type Values Removed Values Added
Description Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37.
Title Use-after-free in the Networking: HTTP component
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Jul 15, 2026, 11:48 AM
Reserved
Jun 15, 2026, 3:08 PM

View source JSON

Updated
Jul 15, 2026, 11:48 AM

JSON

Status
Modified
Published
Jun 16, 2026, 1:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

Severity
Important
Public date
Jun 16, 2026, 11:52 AM

View source Bugzilla JSON

Updated
Jun 18, 2026, 10:15 PM

JSON