CVE-2026-12291 is a use-after-free vulnerability affecting the Networking: HTTP component in Mozilla Firefox. This memory safety issue could lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. The CVSS v3.1 base score is 8.8 (high severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Mozilla has published official advisories confirming the fix. No known exploits have been observed in the wild.

Successful exploitation of this use-after-free vulnerability could lead to arbitrary code execution, memory corruption, and denial of service, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8. There are no reports of active exploitation in the wild.

Mozilla has released official fixes for this vulnerability in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Users and administrators should update affected Firefox installations to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No alternative mitigations or workarounds are indicated in the vendor advisories.