CVE-2026-12330

5.4 MEDIUM

Incorrect boundary conditions in the Internationalization component

Published: 2026-06-16 · Last updated: 2026-06-16

Severity and scoring

CVSS: 5.4 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE: CWE-119

Affected products

Vendor	Product
mozilla	firefox, thunderbird

Description

Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-12330
[Other]https://bugzilla.mozilla.org/show_bug.cgi?id=2029326
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-58/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-59/
[Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2026-61/

Related CVEs

Same vendor

CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
CVE-2026-12328 — Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (8.1 HIGH)
CVE-2026-12323 — Spoofing issue in the DOM: Core & HTML component (5.4 MEDIUM)
CVE-2026-12322 — Clickjacking issue in the Widget: Gtk component (5.4 MEDIUM)
CVE-2026-12321 — JIT miscompilation in the JavaScript: WebAssembly component (5.4 MEDIUM)

Same CWE

CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
CVE-2026-12327 — Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (7.3 HIGH)
CVE-2026-12326 — Memory safety bugs present in Firefox 151 and Thunderbird 151 (7.3 HIGH)
CVE-2026-12318 — Incorrect boundary conditions in the Libraries component in NSS (7.3 HIGH)
CVE-2026-12317 — Memory safety bug fixed in Thunderbird 152 (7.5 HIGH)