CVE-2026-12307 - Vulnerability Details

- Memory safety bug fixed in Thunderbird 152

Description

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Published: 2026-06-16

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a memory safety bug that has been identified in both Firefox and Thunderbird. Versions 152 (and ESR 140.12) contain the fix. Prior to the patch, the bug could lead to crashes or other unexpected behaviors due to a memory safety violation. It is classified as a buffer overflow (CWE‑119) and improper handling of sensitive information (CWE‑825).

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. For Firefox the fix is available in version 152 and in the ESR branch at 140.12. Thunderbird receives its mitigation in releases 152 and 140.12. No other browsers or products are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 suggests a medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be local or requires crafted input, as the vulnerability is a memory safety issue. With no known exploitation reports, the overall risk is moderate to low for most environments, yet users should still apply the fix to prevent potential exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.12`	unaffected	≤ 140.*
`152`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.12`	unaffected	≤ 140.*
`152`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[140.12,140.*]`	unaffected	generic	—
`[152,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Mozilla Firefox to version 152 or later, or to ESR 140.12 or newer
Update Mozilla Thunderbird to version 152 or newer, or to ESR 140.12 or newer
If an immediate update is not possible, avoid using features that may trigger the unsafe memory operation until a patch is applied

Generated by OpenCVE AI on October 23, 2026 at 00:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4635-1	firefox-esr security update
Debian DLA	DLA-4636-1	thunderbird security update
Debian DSA	DSA-6350-1	firefox-esr security update
Debian DSA	DSA-6351-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00261.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2038133
https://nvd.nist.gov/vuln/detail/CVE-2026-12307
https://www.cve.org/CVERecord?id=CVE-2026-12307
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-58/
https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12307
https://www.mozilla.org/security/advisories/mfsa2026-60/
https://www.mozilla.org/security/advisories/mfsa2026-61/
https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12307

History

Wed, 21 Oct 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.	Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Title	Memory safety bug fixed in Firefox 152	Memory safety bug fixed in Thunderbird 152

Thu, 18 Jun 2026 18:45:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.	Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Title	Memory safety bug fixed in Thunderbird 152	Memory safety bug fixed in Firefox 152

Thu, 18 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12307 https://www.cve.org/CVERecord?id=CVE-2026-12307 https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12307 https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12307
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 16 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 16 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.	Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Title	Memory safety bug fixed in Firefox 152	Memory safety bug fixed in Thunderbird 152
References		https://www.mozilla.org/security/advisories/mfsa2026-60/ https://www.mozilla.org/security/advisories/mfsa2026-61/

Tue, 16 Jun 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 16 Jun 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Title		Memory safety bug fixed in Firefox 152
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2038133 https://www.mozilla.org/security/advisories/mfsa2026-57/ https://www.mozilla.org/security/advisories/mfsa2026-58/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-06-16T11:52:40.757Z

Updated: 2026-10-21T13:50:01.988Z

Reserved: 2026-06-15T15:08:13.454Z

Link: CVE-2026-12307

Vulnrichment

Updated: 2026-06-16T17:37:11.140Z

NVD

Status : Modified

Published: 2026-06-16T13:16:30.933

Modified: 2026-10-26T13:10:00.140

Link: CVE-2026-12307

Redhat

Severity : Moderate

Publid Date: 2026-06-16T11:52:40Z

Links: CVE-2026-12307 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:45:13Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object