CVE-2026-12305 is a memory safety bug classified under CWE-119 affecting Mozilla Firefox and Thunderbird prior to versions Firefox 152 and Firefox ESR 140.12. The vulnerability was addressed as part of a broader set of memory safety fixes in Firefox 152 and Thunderbird 152, as well as Firefox ESR 140.12 and Thunderbird ESR 140.12. These bugs showed evidence of memory corruption and could potentially be exploited to cause denial of service or other impacts, though no confirmed exploitation in the wild is known. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a high impact on availability without impact on confidentiality or integrity. Mozilla published security advisories MFSA 2026-57 and MFSA 2026-58 detailing these fixes.

The vulnerability impacts availability by causing potential denial-of-service conditions due to memory safety issues. There is no direct impact on confidentiality or integrity according to the CVSS vector. While memory corruption was observed, no confirmed exploitation in the wild has been reported. The vulnerability affects users running Firefox versions prior to 152 and Firefox ESR versions prior to 140.12, as well as corresponding Thunderbird versions. Successful exploitation could disrupt browser or email client operation.

Mozilla has released official fixes for this vulnerability in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by Mozilla advisories MFSA 2026-57 and MFSA 2026-58.