Memory safety bugs fixed in Firefox 152 and Thunderbird 152

Summary

CVE	CVE-2026-12326
State	PUBLISHED
Assigner	mozilla
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-16 13:16:33 UTC
Updated	2026-06-30 03:17:12 UTC
Description	Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Risk And Classification

Primary CVSS: v3.1 8.1 HIGH from ADP

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.002510000 probability, percentile 0.163160000 (date 2026-07-04)

Problem Types: CWE-119 | CWE-825 | CWE-119 CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | CWE-825 Expired Pointer Dereference

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	8.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	ADP	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	8.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Mozilla	Firefox	All	All	All	All
Application	Mozilla	Thunderbird	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Mozilla	Firefox	unaffected 152 * rpm	Not specified
CNA	Mozilla	Thunderbird	unaffected 152 * rpm	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified

References

Reference	Source	Link	Tags
bugzilla.mozilla.org/buglist.cgi	[email protected]	bugzilla.mozilla.org	Broken Link
bugzilla.mozilla.org/buglist.cgi	[email protected]	bugzilla.mozilla.org	Broken Link
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12326.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
access.redhat.com/security/cve/CVE-2026-12326	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
www.mozilla.org/security/advisories/mfsa2026-57	[email protected]	www.mozilla.org	Vendor Advisory
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
bugzilla.mozilla.org/buglist.cgi	[email protected]	bugzilla.mozilla.org	Broken Link
www.mozilla.org/security/advisories/mfsa2026-60	[email protected]	www.mozilla.org	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Ashley Zebrowski, Christian Holler, Dan Baker, Jan de Mooij, Jon Coppeard, Maurice Dauer, Nicolas B. Pierron, Nika Layzell, Randell Jesup, Rob Wu, Ryan Hunt, Steve Fink, Tom Schuster, Tomoya Nakanishi, Yannis Juglaret, Serge Guelton and the Mozilla Fuzzing Team (en)

Additional Advisory Data

Source	Time	Event
ADP	2026-06-16T14:01:41.236Z	Reported to Red Hat.
ADP	2026-06-16T11:52:59.767Z	Made public.

There are currently no legacy QID mappings associated with this CVE.