Skip to content

BaselineWatch

Desk

CVE-2026-12308

5.3 medium SSVC exploitation: none Modified

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Fix

Patch, vendor advisory and mitigation references on NVD 4

https://www.mozilla.org/security/advisories/mfsa2026-57/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-58/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-60/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-61/ Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 5

2026-10-21 16:34CwesCWE-119NVD modified 2026-10-21 14:17
2026-10-21 16:34Cpes+4 CPE criteria (now 4)NVD modified 2026-10-21 14:17
2026-10-21 16:34StatusPublished → ModifiedNVD modified 2026-10-21 14:17
2026-10-21 16:34CVSS5.3 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)NVD modified 2026-10-21 14:17
2026-10-21 15:24First seenunscored · mozillaNVD modified 2026-10-21 13:50

Affected (CPE criteria) 4

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

References 5

https://bugzilla.mozilla.org/show_bug.cgi?id=2038302 Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-57/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-58/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-60/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-61/ Vendor Advisory