CVE-2026-12328

8.1 HIGH

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151

Published: 2026-06-16 · Last updated: 2026-06-16

Severity and scoring

CVSS: 8.1 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-120

Affected products

Vendor	Product
mozilla	firefox, thunderbird

Description

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-12328
[Other]https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029402%2C2038477%2C2039726%2C2041373%2C2042268%2C2042451%2C2042782%2C2042858%2C2042929%2C2042965%2C2043213
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-57/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-58/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-59/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-60/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-61/

Related CVEs

Same vendor

CVE-2026-12330 — Incorrect boundary conditions in the Internationalization component (5.4 MEDIUM)
CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
CVE-2026-12323 — Spoofing issue in the DOM: Core & HTML component (5.4 MEDIUM)
CVE-2026-12322 — Clickjacking issue in the Widget: Gtk component (5.4 MEDIUM)
CVE-2026-12321 — JIT miscompilation in the JavaScript: WebAssembly component (5.4 MEDIUM)

Same CWE

CVE-2026-12192 — A vulnerability was determined in GALAYOU Y4 1.0.0 (8.8 HIGH)
CVE-2026-36818 — Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter... (7.5 HIGH)
CVE-2026-36817 — Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo paramet... (7.5 HIGH)
CVE-2026-36816 — Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo paramete... (7.5 HIGH)
CVE-2026-36815 — Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the hostname parameter of the fo... (7.5 HIGH)