VulnerabilityModified
CVE-2026-12298
This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
MEDIUM 5.4EPSS 0.31%
Does this matter?
Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.
Description
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- EPSS
- 0.31% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125, CWE-416, CWE-787, CWE-843
- Affected
- mozilla/firefox · mozilla/thunderbird
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2041981Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-57/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-58/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-60/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-61/Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:27717
- https://access.redhat.com/errata/RHSA-2026:27733
- https://access.redhat.com/errata/RHSA-2026:27734
- https://access.redhat.com/errata/RHSA-2026:29940
- https://access.redhat.com/errata/RHSA-2026:30846
- https://access.redhat.com/errata/RHSA-2026:33445
- https://access.redhat.com/errata/RHSA-2026:36100
- https://access.redhat.com/errata/RHSA-2026:36101
- https://access.redhat.com/errata/RHSA-2026:36102
- https://access.redhat.com/errata/RHSA-2026:36103
- https://access.redhat.com/errata/RHSA-2026:37210
- https://access.redhat.com/errata/RHSA-2026:37391
- https://access.redhat.com/errata/RHSA-2026:38506
- https://access.redhat.com/errata/RHSA-2026:38750
- https://access.redhat.com/errata/RHSA-2026:38751
- https://access.redhat.com/errata/RHSA-2026:38753
- https://access.redhat.com/errata/RHSA-2026:39011
- https://access.redhat.com/errata/RHSA-2026:39141
- https://access.redhat.com/errata/RHSA-2026:39142
- https://access.redhat.com/errata/RHSA-2026:39428
- https://access.redhat.com/errata/RHSA-2026:39706
- https://access.redhat.com/security/cve/CVE-2026-12298
- https://bugzilla.redhat.com/show_bug.cgi?id=2489248
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12298.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.