CVE-2026-12309: Mozilla Firefox and Thunderbird Memory Safety Vulnerability (CVSS 6.5)

Technical summary

This vulnerability is rooted in a memory safety defect classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The network-accessible attack surface, combined with low attack complexity and no privilege or user interaction requirements, allows remote exploitation. The vulnerability impacts the confidentiality and availability of the affected software; however, integrity is not compromised. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L yields a score of 6.5 (MEDIUM severity).

Business impact

Organizations relying on Firefox or Thunderbird for employee communication and browsing face operational disruption risk through denial-of-service conditions, as well as potential information disclosure if sensitive data resides in the affected process memory. The lack of elevation requirements or user interaction means that simply visiting a malicious website or receiving a crafted message could trigger exploitation. However, the MEDIUM severity classification suggests the impact is contained and does not represent a critical system compromise vector on its own.

Affected systems

This vulnerability affects Mozilla Firefox (all versions prior to 152), Firefox Extended Support Release (ESR) versions prior to 140.12, Mozilla Thunderbird (all versions prior to 152), and Thunderbird versions prior to 140.12. Organizations should verify their deployed versions of these applications across endpoints and servers.

Exploitability

The vulnerability is exploitable remotely without requiring authentication, user privileges, or user interaction. An attacker can craft network traffic or host malicious web content to trigger the memory safety bug. This low-friction attack surface makes the vulnerability practically exploitable in real-world scenarios, despite its MEDIUM CVSS score. However, the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active in-the-wild exploitation as of the publication date.

Remediation

Patch Firefox to version 152 or later, Firefox ESR to version 140.12 or later, Thunderbird to version 152 or later, and Thunderbird ESR to version 140.12 or later. Deployment should occur as part of routine patch management cycles. Because this is a memory safety defect with network attack surface, timely patching is recommended within 30 days of release to reduce exposure window.

Patch guidance

Users and administrators should enable automatic updates for Firefox and Thunderbird, or manually verify installation of the fixed versions. For Firefox ESR and Thunderbird ESR deployments in enterprise environments, verify that your ESR branch aligns with the patched releases (140.12 or later for the 140 branch). Check your current version via the application's About menu and compare against the vendor advisories. Deployment should prioritize systems where Firefox or Thunderbird are used to access untrusted content or handle sensitive communications.

Detection guidance

Endpoint Detection and Response (EDR) tools should monitor for memory-corruption exploitation patterns targeting Firefox and Thunderbird processes, including unusual process crashes, memory access violations, or unexpected child process spawning. Network detection can flag unusual outbound connections from browser processes. Vulnerability scanners should be configured to detect Firefox and Thunderbird versions and alert on versions predating the patched releases. Log aggregation systems should collect browser crash reports and correlate them with known exploitation indicators.

Why prioritize this

Although classified as MEDIUM severity, the network attack surface combined with no authentication or user interaction requirements warrants prompt patching. The vulnerability affects two widely deployed applications (Firefox and Thunderbird) across consumer and enterprise environments. Memory safety bugs in browser engines historically represent a vector for advanced attackers, even when individual CVEs carry moderate CVSS scores. Priority should be elevated in environments where Firefox or Thunderbird handle sensitive communications or connect to untrusted networks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the attack vector (network-accessible), attack complexity (low), absence of privilege or user interaction requirements, and limited scope. The confidentiality and availability impacts are present but not critical. The integrity impact is absent, lowering the overall severity. This MEDIUM rating is appropriate for a memory safety bug without evidence of widespread exploitation or a clear path to full system compromise, though the lack of mitigating factors (authentication, user action) ensures practical exploitability.

Frequently asked questions