CVE-2026-12309 is a memory safety bug classified under CWE-119 that was present in Firefox versions before 152 and Firefox ESR versions before 140.12. The vulnerability was addressed and fixed in Firefox 152 and Firefox ESR 140.12, along with Thunderbird 152 and Thunderbird ESR 140.12. The CVSS 3.1 vector indicates the vulnerability can be exploited remotely without privileges or user interaction, causing low confidentiality impact and low availability impact. Mozilla's security advisories MFSA 2026-57 and MFSA 2026-58 provide detailed information on the fixes. The vulnerability is part of a broader set of memory safety bugs fixed in these releases, some of which showed evidence of memory corruption and potential for arbitrary code execution.

The vulnerability allows remote attackers to exploit a memory safety bug that could lead to memory corruption. While the confidentiality impact is low and integrity is not affected, availability impact is low, the presence of memory corruption suggests a potential for arbitrary code execution with sufficient effort. No known exploits in the wild have been reported. The CVSS score of 6.5 reflects a medium severity risk.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the vulnerability. Since this is not a cloud service, manual patching is required. There is no indication from the vendor advisory that no action is required or that the issue is already mitigated without patching.