CVE-2026-12329 is a memory safety bug in Mozilla Firefox ESR and Thunderbird that was resolved in version 140.12 of both products. The vulnerability involves memory corruption issues classified under CWE-119, CWE-416, and CWE-476. The CVSS v3.1 base score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and low impact on availability. The vendor advisory from Mozilla (MFSA 2026-58) confirms the fix and lists this vulnerability among multiple memory safety bugs addressed in the release. No known exploits in the wild have been reported.

The vulnerability can cause a denial of service due to memory corruption in affected versions of Firefox ESR and Thunderbird prior to 140.12. There is no reported impact on confidentiality or integrity. The CVSS score of 5.3 reflects a medium severity primarily due to availability impact. No known active exploitation has been observed.

Mozilla has released an official fix for this vulnerability in Firefox ESR 140.12 and Thunderbird 140.12. Users and administrators should upgrade to these versions or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation steps are required beyond applying the official update.