CVE-2018-12406: Buffer Overflow
Last updated 25 August 2025
Other sources
Mozilla developers and community members Alex Gaynor, André Bargull, Boris Zbarsky, Christian Holler, Jan de Mooij, Jason Kratzer, Philipp, Ronald Crane, Natalia Csoregi, and Paul Theriault reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64.
— Launchpad
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2018-12406?
The severity of CVE-2018-12406 is critical with a CVSS score of 8.8.
Which software is affected by CVE-2018-12406?
Mozilla Firefox versions up to and including 64.0 are affected by CVE-2018-12406.
Are any Ubuntu Linux versions affected by CVE-2018-12406?
Yes, Canonical Ubuntu Linux versions 14.04, 16.04, 18.04, and 18.10 are affected by CVE-2018-12406.
How can I fix CVE-2018-12406 in Firefox?
To fix CVE-2018-12406 in Firefox, update to version 64.0 or newer.
Where can I find more information about CVE-2018-12406?
You can find more information about CVE-2018-12406 on the following references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/buglist.cgi?bug_id=1456947%2C1475669%2C1504816%2C1502886%2C1500064%2C1500310%2C1500696%2C1499198%2C1434490%2C1481745%2C1458129), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/), [SecurityFocus](http://www.securityfocus.com/bid/106167).