CVE-2026-12306 is a memory safety bug classified under CWE-119 affecting Mozilla Firefox and Thunderbird. It was present in Firefox versions before 152 and Firefox ESR before 140.12. The vulnerability involves memory corruption that could potentially be exploited to execute arbitrary code, although no known exploits are reported in the wild. Mozilla fixed this vulnerability in Firefox 152 and Firefox ESR 140.12, as part of a larger batch of memory safety fixes addressing multiple related issues. The CVSS 3.1 base score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact without integrity or availability impact.

The vulnerability allows an attacker to cause memory corruption remotely without requiring user interaction or privileges, potentially leading to limited confidentiality loss. There is no direct impact on integrity or availability reported. While no exploits are known in the wild, the presence of memory corruption indicates a risk that could be leveraged for arbitrary code execution with sufficient effort.

Mozilla has provided official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. There are no indications that additional mitigations are required beyond applying the official patches.