CVE-2026-12298: Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Other sources
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 152 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.12 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 152 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 140.12
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-12289
- CVE-2026-12290
- CVE-2026-12291
- CVE-2026-12292
- CVE-2026-12294
- CVE-2026-12295
- CVE-2026-12298
- CVE-2026-12296
- CVE-2026-12297
- CVE-2026-12299
- CVE-2026-12329
- CVE-2026-12302
- CVE-2026-12304
- CVE-2026-12305
- CVE-2026-12306
- CVE-2026-12307
- CVE-2026-12308
- CVE-2026-12309
- CVE-2026-12310
- CVE-2026-12311
- CVE-2026-12312
- CVE-2026-12313
- CVE-2026-12314
- CVE-2026-12315
- CVE-2026-12330
- CVE-2026-12324
- CVE-2026-12325
- CVE-2026-12327
- CVE-2026-12328
- CVE-2026-12293
- CVE-2026-12300
- CVE-2026-12301
- CVE-2026-12303
- CVE-2026-12316
- CVE-2026-12317
- CVE-2026-12318
- CVE-2026-12319
- CVE-2026-12320
- CVE-2026-12321
- CVE-2026-12322
- CVE-2026-12323
- CVE-2026-12326
Frequently Asked Questions
What is the severity of CVE-2026-12298?
The severity of CVE-2026-12298 is medium, with a CVSS score of 5.4.
How do I fix CVE-2026-12298?
To fix CVE-2026-12298, upgrade to Thunderbird version 152 or Firefox version 152.
What type of vulnerability is CVE-2026-12298?
CVE-2026-12298 is classified as a memory safety bug in Mozilla software.
Which software is affected by CVE-2026-12298?
CVE-2026-12298 affects Mozilla Thunderbird and Mozilla Firefox.
What impact does CVE-2026-12298 have?
CVE-2026-12298 may lead to potential information disclosure due to a use after free vulnerability.