Firefox Memory Safety bug fixed in 152 ESR 140.12/115.37
CVE-2026-12290 Published on June 16, 2026
Memory safety bug fixed in Firefox 152
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Vulnerability Analysis
CVE-2026-12290 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is a Buffer Overflow Vulnerability?
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CVE-2026-12290 has been classified to as a Buffer Overflow vulnerability or weakness.
What is an Untrusted pointer offset Vulnerability?
The program performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
CVE-2026-12290 has been classified to as an Untrusted pointer offset vulnerability or weakness.
Products Associated with CVE-2026-12290
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-12290 are published in these products:
Affected Versions
Mozilla Firefox:- Version 115.37, <= 115.* is unaffected.
- Version 140.12, <= 140.* is unaffected.
- Version 152, <= * is unaffected.
- Version 140.12, <= 140.* is unaffected.
- Version 152, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.