CVE-2026-12310 is a memory safety bug affecting Mozilla Firefox and Thunderbird prior to Firefox 152 and Firefox ESR 140.12. This vulnerability involves memory corruption issues classified under several CWEs including buffer overflows and use-after-free conditions. The Mozilla security advisories MFSA2026-57 and MFSA2026-58 confirm that this vulnerability and multiple related memory safety bugs were fixed in Firefox 152 and Firefox ESR 140.12. The CVSS 3.1 base score is 7.5, indicating a high impact primarily on confidentiality (high impact on confidentiality, no impact on integrity or availability). No known exploits in the wild have been reported. The vendor advisories provide detailed references to bug reports and confirm the availability of patches.

Successful exploitation of this memory safety vulnerability could lead to memory corruption that may allow an attacker to execute arbitrary code remotely without user interaction. The CVSS vector indicates the attack requires no privileges and no user interaction, with network attack vector and high confidentiality impact. There is no reported impact on integrity or availability. No known active exploitation has been observed, but the potential for arbitrary code execution represents a significant security risk.

Official patches are available and have been released by Mozilla in Firefox 152 and Firefox ESR 140.12, as well as corresponding Thunderbird versions. Users and administrators should upgrade to Firefox 152 or later, or Firefox ESR 140.12 or later, to remediate this vulnerability. No additional mitigation steps are required beyond applying these official updates.