CVE-2026-12300 is a memory safety bug in Mozilla Firefox and Thunderbird identified and fixed in version 152. It is part of a broader set of memory safety vulnerabilities addressed simultaneously in Firefox 152 and Thunderbird 152. The vulnerability could lead to limited confidentiality impact but no integrity or availability impact, with no privileges or user interaction required for exploitation. Mozilla's official security advisories confirm the fix and provide detailed references to the underlying bugs. The vulnerability affects all versions prior to Firefox 152 and Thunderbird 152.

The vulnerability could allow an attacker to cause limited information disclosure due to memory safety issues. There is no impact on integrity or availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits in the wild have been reported. The overall severity is medium.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Thunderbird 152. Users and administrators should update to these versions or later to remediate the issue. Since this is a client-side application vulnerability, applying the official update is the recommended and effective mitigation. Patch status is confirmed by Mozilla advisories.