CVE-2026-12328

Modified Modified - Updated After Analysis

Memory Corruption in Firefox and Thunderbird

Publication date: 2026-06-16

Last updated on: 2026-07-07

Assigner: Mozilla Corporation

Description

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-16

Last Modified

2026-07-07

Generated

2026-07-07

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-06

NVD

CVE-2026-12328

EUVD

EUVD-2026-37074

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 152.0 (exc)
mozilla	firefox	to 115.37.0 (exc)
mozilla	firefox	From 140.0 (inc) to 140.12.0 (exc)
mozilla	thunderbird	to 152.0.0 (exc)
mozilla	thunderbird	From 140.0 (inc) to 140.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-825	The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves memory safety bugs found in specific versions of Firefox ESR, Firefox, and Thunderbird. These bugs show evidence of memory corruption, which means that an attacker could potentially exploit them to execute arbitrary code on the affected systems.

The affected versions include Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. The issue was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37.

Impact Analysis

This vulnerability can lead to memory corruption, which an attacker could exploit to run arbitrary code on your system. This means an attacker might be able to execute malicious actions, potentially compromising your system's security.

Exploitation could allow attackers to gain elevated privileges within the application, leading to unauthorized system access or further exploitation.

Mitigation Strategies

To mitigate this vulnerability, you should update affected Mozilla products to the fixed versions.

Update Firefox ESR to version 115.37 or later.
Update Firefox ESR to version 140.12 or later.
Update Firefox to version 152 or later.
Update Thunderbird ESR to version 140.12 or later.
Update Thunderbird to version 152 or later.

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-12328. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70