CVE-2026-12317 is a memory safety bug classified under CWE-119 that was present in Firefox versions before 152. It was fixed in Firefox 152 as part of a broader security update addressing multiple memory safety issues. The vulnerability could lead to denial of service or potentially arbitrary code execution due to memory corruption. The CVSS v3.1 base score is 7.5 (high), with attack vector network, low complexity, no privileges or user interaction needed, and an impact on availability but no confidentiality or integrity impact. Mozilla's official security advisory confirms the fix in Firefox 152 and Thunderbird 152. There are no known exploits in the wild at the time of publication.

The vulnerability can cause denial of service or potentially allow arbitrary code execution due to memory corruption. It does not impact confidentiality or integrity directly. The attack can be performed remotely without privileges or user interaction, making it a significant risk if unpatched. However, no known exploits have been observed in the wild.

Mozilla has released an official fix for this vulnerability in Firefox 152. Users and administrators should update affected Firefox installations to version 152 or later to remediate this issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.