CVE-2026-12298 is a memory safety bug in Mozilla Firefox and Firefox ESR that was resolved in Firefox 152 and Firefox ESR 140.12. The vulnerability is part of a set of memory safety issues fixed in these releases, some of which showed evidence of memory corruption and potential for exploitation to run arbitrary code. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The vendor advisory confirms the fix availability and provides detailed references to the bugs addressed. No known exploits in the wild have been reported.

The vulnerability could allow an attacker to cause memory corruption, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates that exploitation requires user interaction but no privileges. There is no reported impact on availability. While some memory safety bugs fixed alongside this one have high impact, CVE-2026-12298 itself is rated medium severity. No known active exploitation has been reported.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. No additional mitigation actions are specified by the vendor advisory.