CVE-2026-12317: Memory safety bug fixed in Thunderbird 152

Synopsis

A memory safety bug in Mozilla Thunderbird (and Firefox) allows a remote, unauthenticated attacker to trigger a crash by sending specially crafted network data, requiring no user interaction. Successful exploitation causes a denial of service by crashing the affected application. A patched-image rebuild at version 152 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected service over the network; no local access or physical proximity is required.

• AuthenticationNot required

  No credentials or prior account access are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need the user to click, open, or interact with anything; exploitation is fully remote and passive.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or environmental factors required to land the attack.

Blast Radius

• Crashes the Thunderbird or Firefox process entirely, making the application unavailable until restarted.
• Any in-progress work such as unsent email drafts or active browsing sessions is lost at the moment of crash.
• Repeated exploitation can prevent users from accessing the application at all, effectively blocking email and browser workflows.