This vulnerability is a memory safety bug classified under CWE-119, fixed in Mozilla Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird ESR 140.12. The bug could cause memory corruption, which might be exploited to execute arbitrary code. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a high impact on confidentiality with no impact on integrity or availability. The Mozilla advisories mfsa2026-57 and mfsa2026-58 detail multiple memory safety bugs fixed in these versions, including CVE-2026-12312. The vendor has officially fixed this issue in the stated versions.

The vulnerability allows an attacker to cause memory corruption remotely without privileges or user interaction, potentially leading to disclosure of sensitive information or arbitrary code execution. The CVSS vector indicates a high confidentiality impact but no impact on integrity or availability. No known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisories. No additional mitigation steps are specified or required beyond applying the official updates.