CVE-2026-12317: Firefox and Thunderbird Memory Safety Flaw (CVSS 7.5)

Technical summary

CVE-2026-12317 is a memory safety defect (CWE-119) in Firefox and Thunderbird that triggers an out-of-bounds condition under network-accessible conditions. With a CVSS 3.1 score of 7.5 (high severity), the vulnerability requires no authentication, no user action, and no special system privileges—the attacker simply needs network access to the affected application. The attack vector is network-based and the impact is availability-focused: successful exploitation results in application crash or instability, not data theft or code execution.

Business impact

Widespread crashes of Firefox or Thunderbird in your organization could disrupt email communications, collaborative work, and web-based business operations. Users relying on Thunderbird for email access will experience service interruptions. Firefox deployments supporting internal or customer-facing web applications face potential uptime impact. The attack is trivial to trigger from the network, making it exploitable at scale without sophisticated tooling.

Affected systems

All versions of Mozilla Firefox and Mozilla Thunderbird prior to version 152 are affected. Organizations running Firefox as their standard browser, or Thunderbird as their email client, should verify their current versions and plan upgrades. Users on auto-update may already be protected if they have applied version 152 or later.

Exploitability

This vulnerability has a low barrier to exploitation. No special privileges, no user interaction, and no complex setup are required—an attacker can trigger the memory safety defect via network access alone. The CVSS vector reflects this ease: AC:L (low attack complexity) and PR:N, UI:N (no privileges or user action needed). However, it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active, weaponized exploitation in the wild as of the advisory date.

Remediation

Organizations should update Firefox to version 152 or later and Thunderbird to version 152 or later. For Firefox, users with auto-update enabled may be automatically protected. For managed deployments, verify rollout of the patched versions across all endpoints. Thunderbird users should manually check for updates or ensure auto-update is configured. No workarounds are available; patching is the only effective mitigation.

Patch guidance

Obtain Firefox 152+ and Thunderbird 152+ from Mozilla's official distribution channels (mozilla.org or your organization's software repository). Verify checksums or digital signatures if your security policy requires it. Test the update in a small cohort before broad rollout, particularly for Thunderbird, since email client changes can affect workflows. For enterprises, coordinate with desktop management or endpoint management tools to stage and monitor the update. No intermediate patches are expected; move directly to 152.

Detection guidance

Monitor for application crash logs and user reports of Firefox or Thunderbird becoming unresponsive or closing unexpectedly. Network intrusion detection systems may flag malformed packets targeting these applications if sent at scale, though the attack itself leaves minimal network-level signatures. Endpoint detection and response (EDR) tools should log process termination events. Correlation with timeline of patch deployment will help distinguish genuine exploitation attempts from normal instability. Additionally, verify installed versions of Firefox and Thunderbird across your fleet using endpoint inventory or managed deployment tools.

Why prioritize this

Despite a lack of known weaponized exploitation, this vulnerability scores HIGH (7.5) and is trivial to exploit remotely without any user interaction. The combination of ease of trigger, network accessibility, and immediate availability impact warrants prompt patching—especially in environments where browser or email uptime directly affects productivity. Organizations should not delay deployment simply because KEV status is negative; that status reflects observed attacks, not potential risk.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the attack's network accessibility (AV:N), low complexity (AC:L), absence of authentication or user action requirements (PR:N, UI:N), and high availability impact (A:H). The severity is not CRITICAL because there is no confidentiality or integrity compromise (C:N, I:N)—the attack is denial-of-service only. However, the ease of trigger and lack of friction elevate the score into the HIGH range, signaling that patching should be treated as urgent rather than routine maintenance.

Frequently asked questions