CVE-2026-12328
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Memory safety bugs were found in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code.
Risk Assessment
An attacker could exploit these vulnerabilities to execute arbitrary code remotely on the victim's system, potentially leading to full compromise of the application and user data.
Recommendation
Immediately update Firefox and Thunderbird to versions 152, 140.12, or 115.37, depending on the release branch used.
Original NVD description (English source)
Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.