CVE-2026-12326

Memory safety bugs fixed in Firefox 152 and Thunderbird 152

Published Jun 16, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Analysis

Technical impact

Mozilla released memory safety bugs in Firefox 151 and Thunderbird 151 that caused memory corruption. The bugs exhibit the potential to be exploited for arbitrary code execution. The weaknesses are categorized as CWE-119 and CWE-825, both of which can lead to arbitrary code execution when triggered.

Affected Systems

The affected products are Mozilla Firefox and Mozilla Thunderbird. Versions up to and including 151 are vulnerable; the vulnerability was fixed in Firefox 152 and Thunderbird 152.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity risk. The EPSS score is less than 1 %, suggesting that exploitation of this vulnerability is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly stated in the advisory, but based on the description it is inferred that the exploit would require the affected application to be executed, potentially with user interaction or via a malicious webpage or email attachment. No public proof‑of‑concept is disclosed, so the likelihood remains low, yet the high impact warrants prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`152`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`152`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[152,*]`	unaffected	generic	—

Mozilla

Thunderbird

Version	Status	Scheme	Platform
`151`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor patch that addresses the memory corruption flaws (CWE-119 and CWE-825).
Limit execution of untrusted add‑ons or plugins that could trigger buffer overflows (CWE-119) or uncontrolled input (CWE-825) in Firefox, and quarantine or disable processing of untrusted email attachments in Thunderbird until the patch is applied.
Continuously monitor application logs and system activity for anomalous memory access or crashes that could indicate an attempt to exploit buffer overflows (CWE-119) or integer overflows (CWE-825) in similar memory corruption vulnerabilities.

Generated by OpenCVE AI on June 25, 2026 at 14:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.363% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-12326
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767455%2C2004308%2C2024445%2C2028182%2C2029765%2C2029883%2C2030110%2C2030149%2C2030366%2C2030374%2C2030564%2C2031120%2C2033411%2C2038695%2C2042465%2C2042781%2C2042907
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021955%2C2025960%2C2029066%2C2029403%2C2029435%2C2029803%2C2030570%2C2030573%2C2032264%2C2033234%2C2034816%2C2035907%2C2035963%2C2036895%2C2036898%2C2036907%2C2036909%2C2036928%2C2036931%2C2036932%2C2036934%2C2039238%2C2039463
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2039050%2C2042718%2C2042760%2C2044831%2C2045307%2C2045398%2C2045516%2C2045572%2C2041741%2C2044433
https://bugzilla.redhat.com/show_bug.cgi?id=2489222
https://nvd.nist.gov/vuln/detail/CVE-2026-12326
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12326.json
https://www.cve.org/CVERecord?id=CVE-2026-12326
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-57/#CVE-2026-12326
https://www.mozilla.org/security/advisories/mfsa2026-60/
https://www.mozilla.org/security/advisories/mfsa2026-60/#CVE-2026-12326

History

Jun 25, 2026 12:45 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12326 https://www.cve.org/CVERecord?id=CVE-2026-12326 https://www.mozilla.org/security/advisories/mfsa2026-57/#CVE-2026-12326 https://www.mozilla.org/security/advisories/mfsa2026-60/#CVE-2026-12326
Metrics	threat_severity `None`	threat_severity `Important`

Jun 17, 2026 11:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 4:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.	Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
References		https://www.mozilla.org/security/advisories/mfsa2026-60/

Jun 16, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox Mozilla thunderbird
Vendors & Products		Mozilla Mozilla firefox Mozilla thunderbird

Jun 16, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.
Title		Memory safety bugs fixed in Firefox 152 and Thunderbird 152
References		https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767455%2C2004308%2C2024445%2C2028182%2C2029765%2C2029883%2C2030110%2C2030149%2C2030366%2C2030374%2C2030564%2C2031120%2C2033411%2C2038695%2C2042465%2C2042781%2C2042907 https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021955%2C2025960%2C2029066%2C2029403%2C2029435%2C2029803%2C2030570%2C2030573%2C2032264%2C2033234%2C2034816%2C2035907%2C2035963%2C2036895%2C2036898%2C2036907%2C2036909%2C2036928%2C2036931%2C2036932%2C2036934%2C2039238%2C2039463 https://bugzilla.mozilla.org/buglist.cgi?bug_id=2039050%2C2042718%2C2042760%2C2044831%2C2045307%2C2045398%2C2045516%2C2045572%2C2041741%2C2044433 https://www.mozilla.org/security/advisories/mfsa2026-57/