CVE-2026-12309 - Vulnerability Details

- Memory safety bug fixed in Thunderbird 152

Description

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Published: 2026-06-16

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The CVE describes a memory safety bug that was addressed in Thunderbird 152 and Firefox 152, along with their ESR counterparts. The flaw could lead to memory corruption, including heap or stack corruption as indicated by CWE‑119 and CWE‑825. While the vendor advisories do not detail an exact attack vector or indicate denial of service or code execution, the bug could corrupt application memory if triggered.

Affected Systems

All Mozilla Firefox versions older than 152 and Firefox ESR versions older than 140.12, as well as all Mozilla Thunderbird versions older than 152 and Thunderbird ESR versions older than 140.12, are potentially affected, according to the vendor advisory.

Risk and Exploitability

The CVSS score is 6.5, placing the vulnerability in the medium severity range. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An explicit attack vector is not disclosed in the description, so the exact conditions to trigger the flaw remain unspecified.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.12`	unaffected	≤ 140.*
`152`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.12`	unaffected	≤ 140.*
`152`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[140.12,141.0.0)`	unaffected	generic	—
`[152,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 152 or newer, or to Firefox ESR 140.12 or newer.
Upgrade Mozilla Thunderbird to version 152 or newer, or to Thunderbird ESR 140.12 or newer.
Monitor Mozilla’s security advisories for additional updates or recommended mitigations.

Generated by OpenCVE AI on October 23, 2026 at 00:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4635-1	firefox-esr security update
Debian DLA	DLA-4636-1	thunderbird security update
Debian DSA	DSA-6350-1	firefox-esr security update
Debian DSA	DSA-6351-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00235.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2038476
https://nvd.nist.gov/vuln/detail/CVE-2026-12309
https://www.cve.org/CVERecord?id=CVE-2026-12309
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-58/
https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12309
https://www.mozilla.org/security/advisories/mfsa2026-60/
https://www.mozilla.org/security/advisories/mfsa2026-61/
https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12309

History

Wed, 21 Oct 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.	Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Title	Memory safety bug fixed in Firefox 152	Memory safety bug fixed in Thunderbird 152

Thu, 18 Jun 2026 18:45:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.	Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Title	Memory safety bug fixed in Thunderbird 152	Memory safety bug fixed in Firefox 152

Thu, 18 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12309 https://www.cve.org/CVERecord?id=CVE-2026-12309 https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12309 https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12309
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 16 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 16 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.	Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Title	Memory safety bug fixed in Firefox 152	Memory safety bug fixed in Thunderbird 152
References		https://www.mozilla.org/security/advisories/mfsa2026-60/ https://www.mozilla.org/security/advisories/mfsa2026-61/

Tue, 16 Jun 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 16 Jun 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Title		Memory safety bug fixed in Firefox 152
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2038476 https://www.mozilla.org/security/advisories/mfsa2026-57/ https://www.mozilla.org/security/advisories/mfsa2026-58/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-06-16T11:52:42.737Z

Updated: 2026-10-21T13:50:02.600Z

Reserved: 2026-06-15T15:08:14.300Z

Link: CVE-2026-12309

Vulnrichment

Updated: 2026-06-16T17:40:32.638Z

NVD

Status : Modified

Published: 2026-06-16T13:16:31.180

Modified: 2026-10-26T13:10:00.140

Link: CVE-2026-12309

Redhat

Severity : Moderate

Publid Date: 2026-06-16T11:52:42Z

Links: CVE-2026-12309 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:45:13Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object