CVE-2026-12291

Modified Modified - Updated After Analysis

Use-after-free in Firefox Networking HTTP Component

Publication date: 2026-06-16

Last updated on: 2026-06-30

Assigner: Mozilla Corporation

Description

Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-16

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-12291

EUVD

EUVD-2026-37082

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 152.0.0 (exc)
mozilla	firefox	to 115.37.0 (exc)
mozilla	thunderbird	to 152.0.0 (exc)
mozilla	thunderbird	to 140.12.0 (exc)
mozilla	firefox	From 128.0 (inc) to 140.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-825	The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Networking: HTTP component of Mozilla Firefox. A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, which can lead to unexpected behavior or security issues.

The issue was addressed and fixed in Firefox version 152, Firefox ESR 140.12, and Firefox ESR 115.37.

Mitigation Strategies

To mitigate this use-after-free vulnerability in the Networking: HTTP component, update Firefox to version 152 or later, or Firefox ESR to version 140.12 or later, or Firefox ESR 115.37 or later.

Impact Analysis

This vulnerability is a use-after-free issue in the Networking: HTTP component of Firefox. Such vulnerabilities can potentially allow attackers to execute arbitrary code, cause crashes, or lead to other unexpected behavior when using affected versions of Firefox.

It was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, so using versions prior to these may expose you to risk.

Hi! I’m here to help you understand CVE-2026-12291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70