CVE-2026-12307 is a memory safety bug classified under CWE-119 affecting Mozilla Firefox and Thunderbird versions prior to Firefox 152 and ESR 140.12. The vulnerability involves memory corruption issues that could be exploited to compromise the application. Mozilla fixed this vulnerability in Firefox 152 and Firefox ESR 140.12, as well as corresponding Thunderbird versions. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. The vendor advisories confirm the fix and list this vulnerability among multiple memory safety bugs resolved in these versions.

The vulnerability could lead to limited confidentiality impact due to memory safety issues, potentially allowing an attacker to cause memory corruption. While no known exploits are reported in the wild, the presence of memory corruption indicates a risk of arbitrary code execution if exploited. The CVSS score of 5.3 indicates a medium severity level, with no impact on integrity or availability reported.

This vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12. Users and administrators should upgrade to these versions or later to mitigate the risk. No additional mitigation steps are required beyond applying the official updates provided by Mozilla.