CVE-2026-12308 is a memory safety bug classified under CWE-119 affecting Mozilla Firefox and Thunderbird prior to versions Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird ESR 140.12. This vulnerability was fixed in these versions as part of a broader set of memory safety fixes addressing multiple bugs that showed evidence of memory corruption. The CVSS v3.1 base score is 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. The vendor advisories confirm that the issue was resolved in Firefox 152 and ESR 140.12 releases. There are no reports of exploitation in the wild.

The vulnerability could allow an attacker to cause memory corruption, potentially leading to information disclosure. The CVSS vector indicates no impact on integrity or availability, and no privileges or user interaction are required to exploit. While arbitrary code execution is presumed possible with sufficient effort, no confirmed exploits are known. The impact is rated medium based on the CVSS score and vendor assessment.

Mozilla has released official fixes for this vulnerability in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are indicated by the vendor advisories.