CVE-2026-12298: Memory Safety Vulnerability in Firefox and Thunderbird

Technical summary

This vulnerability stems from multiple memory safety defects classified under CWE-125 (out-of-bounds read), CWE-416 (use-after-free), CWE-787 (out-of-bounds write), and CWE-843 (type confusion). The CVSS 3.1 score of 5.4 reflects a network-based attack vector requiring user interaction, with low confidentiality and integrity impact but no availability impact. The flaw resides in core Firefox and Thunderbird rendering or scripting engines, where improper bounds checking or object lifecycle management permits memory access violations.

Business impact

Organizations relying on Firefox or Thunderbird for secure communication face potential exposure of user credentials, message content, or cached browsing data if an employee visits a compromised website or opens a specially crafted email attachment. The medium severity rating suggests manageable but not negligible risk, particularly in environments where users access sensitive systems via these browsers. Thunderbird deployments used for enterprise email may warrant faster patching due to the email-based attack surface.

Affected systems

The vulnerability affects Firefox (all versions prior to 152), Firefox ESR (versions before 140.12), Thunderbird (all versions prior to 152), and Thunderbird ESR (versions before 140.12). Extended Support Release users should prioritize ESR-specific patch versions to avoid disrupting stability policies. Desktop and mobile Firefox installations are both in scope, though the user-interaction requirement limits remote exploitation.

Exploitability

Exploitation requires user interaction—specifically, visiting a malicious website or opening a crafted email—making automated, large-scale attacks unlikely. An attacker must host a carefully constructed page or embed a payload in an email to trigger the memory safety bug. This is not a zero-interaction vulnerability and does not appear on the CISA Known Exploited Vulnerabilities list, indicating no active exploitation campaigns have been reported as of the publication date. However, the network attack vector and moderate complexity mean skilled threat actors can reliably develop exploits once the vulnerability is public.

Remediation

Apply Firefox 152 or later, Firefox ESR 140.12 or later, Thunderbird 152 or later, or Thunderbird ESR 140.12 or later depending on your deployment model. For enterprise environments using ESR releases, coordinate updates with your extended support lifecycle; ESR versions receive fewer but more stable updates. No workarounds exist; patching is the only mitigation. Verify successful installation by checking the about:about or Help → About menu to confirm the build version matches the patched release.

Patch guidance

Prioritize patching systems where Firefox or Thunderbird are primary tools for accessing sensitive or untrusted web content. Desktop environments should update immediately upon release availability in your distribution channel. For managed deployments, test the patched versions in a staging environment to ensure compatibility with critical extensions or email server integrations before broad rollout. Thunderbird users should schedule patching during a maintenance window if the application is used for time-sensitive business operations. Mobile Firefox users should enable automatic updates or manually check for updates in the Google Play Store or Apple App Store.

Detection guidance

Monitor for Firefox and Thunderbird processes exhibiting unusual memory access patterns or crashes following user interaction with web content or email attachments. Endpoint detection and response (EDR) solutions should flag abnormal parent-child process relationships or unexpected system calls from browser/email processes. Log browser extension activity and email attachment handling around the publication date to identify potential post-compromise reconnaissance. Network detection should focus on identifying command-and-control communications from compromised browser contexts rather than the exploitation itself, as the vulnerability does not grant remote code execution.

Why prioritize this

While the CVSS score of 5.4 is medium, the attack vector (network-based, user-initiated) and lack of CISA KEV listing suggest lower immediate enterprise risk compared to critical remote code execution flaws. However, Firefox and Thunderbird's ubiquity in security-conscious organizations and the information disclosure risk warrant prioritization within the medium-severity category. Schedule patching within 30 days, with expedited timelines for Thunderbird deployments handling sensitive email communications.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) assigns 5.4 because: network accessibility increases attack surface; low attack complexity allows straightforward exploitation; no privileges required; mandatory user interaction moderates likelihood; single scope (no privilege escalation); low confidentiality impact (data may be leaked but not wholesale compromise); low integrity impact (application state can be corrupted but not arbitrary code execution); and no availability impact (service remains functional). The score appropriately reflects a data-leakage or state-corruption risk rather than a critical flaw.

Frequently asked questions