CVE-2026-12329: Mozilla Firefox and Thunderbird Memory Safety Vulnerability (CVSS 5.3)

Technical summary

CVE-2026-12329 is a memory safety vulnerability classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-416 (Use-After-Free), and CWE-476 (NULL Pointer Dereference). The flaw was introduced in the Firefox and Thunderbird rendering or scripting engine and permits an out-of-bounds memory access or pointer dereference condition. The CVSS 3.1 score of 5.3 reflects network-based exploitability with low attack complexity, no privileges required, and availability impact only. No confidentiality or integrity compromise is possible under the defined attack vector.

Business impact

Exploitation could disrupt email services and web browsing for affected organizations. While not a data breach vector, repeated crashes degrade user productivity and may trigger support ticket volume spikes. For enterprises relying on Thunderbird for email clients, widespread patching will require coordination across desktop deployment pipelines.

Affected systems

Mozilla Firefox (all ESR and stable release lines through 140.11) and Mozilla Thunderbird (all versions through 140.11) are affected. Both Linux, Windows, and macOS platforms are impacted. Verify the exact affected versions against vendor advisories, as point-release designations may vary by distribution channel.

Exploitability

This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and has no known public exploits as of the publication date. The network-accessible attack vector and low complexity suggest weaponization is feasible, but active exploitation has not been confirmed in threat intelligence feeds. The requirement for no user interaction is notable and lowers the barrier to opportunistic attack.

Remediation

Update Firefox to version 140.12 or later and Thunderbird to version 140.12 or later. These versions contain memory safety hardening that eliminates the vulnerable code path. Organizations should prioritize patching for systems exposed to untrusted network content or which process untrusted email messages.

Patch guidance

Patches are available immediately via Mozilla's standard update channels. Firefox ESR deployments should upgrade to 140.12 ESR; standard Firefox installations should upgrade to the corresponding stable or extended-support version 140.12 or later. Thunderbird users receive patches through the built-in update mechanism or vendor repositories. Desktop administrators managing Firefox or Thunderbird via group policy or Mobile Device Management should verify patch availability in their management tools before deployment. Allow 5-7 business days for large-scale rollout to minimize service disruption.

Detection guidance

Monitor for browser or email client crashes correlated with network requests or email receipt. Application event logs on Windows (Event ID 1000, faulting module) or system logs on Linux (segmentation fault) may reveal exploitation attempts. Network-based detection is difficult without full traffic inspection; focus monitoring on endpoints known to process untrusted content. Endpoint Detection and Response (EDR) platforms should flag unexpected process termination of firefox.exe or thunderbird.exe without user-initiated shutdown.

Why prioritize this

Although the CVSS score is moderate (5.3), this vulnerability warrants prompt attention due to its network accessibility and lack of user interaction. The memory safety family of defects (use-after-free, out-of-bounds access) has historically been a source of critical browser vulnerabilities. The availability impact is certain under exploitation. Organizations should treat this as a Standard priority patch rather than deferring it to routine cycles.

Risk score, explained

The CVSS 3.1 base score of 5.3 (Medium severity) reflects the absence of confidentiality and integrity impact, limiting the overall severity despite network accessibility. The attack vector (AV:N), low complexity (AC:L), and no privilege or interaction requirements (PR:N, UI:N) drive exploitability ratings upward, but the scope remains unchanged (S:U) and impact is limited to availability (A:L). The score appropriately captures a denial-of-service risk without amplification for system-wide compromise.

Frequently asked questions