CVE-2026-12312: Memory safety bug fixed in Thunderbird 152

Synopsis

A memory safety bug affects Mozilla Firefox and Thunderbird across all versions prior to the fix releases. The vulnerability is reachable over the network without any authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives an attacker read access to sensitive data from the affected process. Patched-image rebuilds at versions 140.12 and 152 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network; no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to attempt exploitation.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• A successful attacker reads data from the memory space of the affected Firefox or Thunderbird process, which may include cached credentials, session tokens, or message content.
• Confidentiality is fully compromised at the process level; integrity and availability are not affected by this vulnerability.
• Container images embedding affected Firefox or Thunderbird binaries expose any data those processes hold in memory to remote extraction.