CVE-2026-12290: Memory safety bug fixed in Thunderbird 152

Synopsis

A memory safety bug affects Mozilla Firefox and Thunderbird across all versions prior to the fixed releases. The vulnerability is reachable over the network without any authentication, but requires the victim to interact with attacker-controlled content (for example, visiting a malicious page or opening a crafted message). Successful exploitation gives an attacker the ability to read sensitive data and modify application state. Patched-image rebuilds at versions Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's application over the network, meaning the service or client must be exposed to attacker-reachable network traffic.

• AuthenticationNot required

  No credentials or account are needed; the attacker can target any user without prior access.

• Victim interactionRequired

  The victim must take an action such as opening a crafted email message or navigating to a malicious URL for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configuration.

Blast Radius

• A successful attacker reads sensitive application data, which in Thunderbird may include stored email content, contacts, or session credentials.
• A successful attacker modifies application state or in-memory data, potentially altering message display or injecting content into the running process.
• Confidentiality and integrity of the affected Mozilla application process are fully compromised; availability is not directly affected by this vulnerability.