CVE-2026-12310: Memory safety bug fixed in Thunderbird 152

Synopsis

A memory safety bug affects Mozilla Firefox and Thunderbird across all versions prior to the fixed releases. The vulnerability is reachable over the network without any authentication or user interaction, based on its CVSS vector (AV:N/PR:N/UI:N). Successful exploitation gives an attacker the ability to read confidential data from the affected process, such as stored credentials, session tokens, or message content. Patched-image rebuilds at versions 140.12 and 152 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Firefox or Thunderbird instance over the network; no local access or physical proximity is needed.

• AuthenticationNot required

  No account credentials or session tokens are needed; an unauthenticated remote party can trigger the vulnerability.

• Victim interactionNot required

  The exploit does not require the user to click a link, open a file, or take any other action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or environmental prerequisites.

Blast Radius

• A successful attacker reads data from the memory space of the affected Firefox or Thunderbird process, which may include stored credentials, OAuth tokens, or cached email content.
• Confidentiality impact is rated High; integrity and availability are unaffected, so the attacker gains read access but cannot modify data or crash the service through this vector alone.
• In a containerized deployment where Firefox or Thunderbird is bundled into an image, a memory disclosure could expose environment variables or secrets mounted into that container.