CVE-2026-12330
Analyzed Analyzed - Analysis Complete

Incorrect Boundary Conditions in Firefox ESR Internationalization Component

Publication date: 2026-06-16

Last updated on: 2026-06-16

Assigner: Mozilla Corporation

Description
Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-16
Last Modified
2026-06-16
Generated
2026-07-06
AI Q&A
2026-06-16
EPSS Evaluated
2026-07-05
NVD
CVE-2026-12330
EUVD
EUVD-2026-37076

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mozilla firefox to 115.37.0 (exc)
mozilla firefox From 140.0 (inc) to 140.12.0 (exc)
mozilla thunderbird From 140.0 (inc) to 140.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect boundary conditions in the Internationalization component of Mozilla Firefox ESR. It means that the software did not properly handle certain limits or edges in processing internationalization data, which could lead to unexpected behavior or security issues. The problem was fixed in Firefox ESR versions 140.12 and 115.37.

Mitigation Strategies

To mitigate this vulnerability, update Firefox ESR to version 140.12 or later, or 115.37 or later, where the issue has been fixed.

Impact Analysis

This vulnerability involves incorrect boundary conditions in the Internationalization component of Mozilla Firefox ESR and Thunderbird. It has a CVSS v3.1 base score of 5.4, indicating a medium severity. The impact includes limited confidentiality and integrity loss, as the vector allows network attack with low complexity and requires user interaction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12330. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart