Memory safety bug in Mozilla Firefox/Thunderbird

Successful exploitation could cause memory corruption and application instability, including crashes or denial of service. Based on Mozilla and downstream advisory language for this release, the vulnerability may also be exploitable for arbitrary code execution in the context of the affected application. In broader affected-product contexts, Mozilla-related advisories also associate the release set with impacts such as information disclosure, privilege escalation, sandbox escape, spoofing, or same-origin policy bypass, but the specific impact confirmed for CVE-2026-12312 itself is a memory safety flaw with potential code-execution consequences.

No vulnerability-specific workaround is provided in the available advisories. Recommended mitigation is prompt patching. Until updates are deployed, reduce exposure by enforcing least privilege, avoiding administrative execution contexts, limiting access to untrusted web content and attachments, enabling exploit-mitigation controls, and using host-based detection/prevention and application control where feasible.

Upgrade affected products to fixed versions: Firefox 152 or later, Firefox ESR 140.12 or later, Thunderbird 152 or later, and Thunderbird ESR 140.12 or later. Debian users should install the patched firefox-esr package version 140.12.0esr-1~deb13u1 or later where applicable.