MEDIUM

CVE-2026-12298

Mozilla Firefox 2026-06-16 CVSS v3.1

CVSS

5.4

Description

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Weakness (CWE)

CWE-125 Out-of-bounds Read

CWE-416 Use After Free

CWE-787 Out-of-bounds Write

CWE-843 Type Confusion

EPSS Score

0.31%

Probability of exploitation in next 30 days

23.5th percentile

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2041981 Permissions Required https://www.mozilla.org/security/advisories/mfsa2026-57/ Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2026-58/ Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2026-60/ Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2026-61/ Vendor Advisory https://access.redhat.com/errata/RHSA-2026:27717 https://access.redhat.com/errata/RHSA-2026:27733 https://access.redhat.com/errata/RHSA-2026:27734 https://access.redhat.com/errata/RHSA-2026:29940 https://access.redhat.com/errata/RHSA-2026:30846 https://access.redhat.com/errata/RHSA-2026:33445 https://access.redhat.com/errata/RHSA-2026:36100 https://access.redhat.com/errata/RHSA-2026:36101 https://access.redhat.com/errata/RHSA-2026:36102 https://access.redhat.com/errata/RHSA-2026:36103 https://access.redhat.com/errata/RHSA-2026:37210 https://access.redhat.com/errata/RHSA-2026:37391 https://access.redhat.com/errata/RHSA-2026:38506 https://access.redhat.com/errata/RHSA-2026:38750 https://access.redhat.com/errata/RHSA-2026:38751 https://access.redhat.com/errata/RHSA-2026:38753 https://access.redhat.com/errata/RHSA-2026:39011 https://access.redhat.com/errata/RHSA-2026:39141 https://access.redhat.com/errata/RHSA-2026:39142 https://access.redhat.com/errata/RHSA-2026:39428 https://access.redhat.com/errata/RHSA-2026:39706 https://access.redhat.com/security/cve/CVE-2026-12298 https://bugzilla.redhat.com/show_bug.cgi?id=2489248 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12298.json

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.