CVE-2026-12298 - Vulnerability Details - OpenCVE

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2041981
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-58/

History

Tue, 16 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-416 CWE-787
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 16 Jun 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Title		Memory safety bug fixed in Firefox 152
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2041981 https://www.mozilla.org/security/advisories/mfsa2026-57/ https://www.mozilla.org/security/advisories/mfsa2026-58/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-06-16T11:52:31.879Z

Updated: 2026-06-16T14:30:35.362Z

Reserved: 2026-06-15T15:08:09.561Z

Link: CVE-2026-12298

Vulnrichment

Updated: 2026-06-16T14:30:29.962Z

NVD

Status : Undergoing Analysis

Published: 2026-06-16T13:16:30.040

Modified: 2026-06-16T15:16:34.873

Link: CVE-2026-12298

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12298", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-06-15T15:08:09.561Z", "datePublished": "2026-06-16T11:52:31.879Z", "dateUpdated": "2026-06-16T14:30:35.362Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "140.12", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "152", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12."}]}], "title": "Memory safety bug fixed in Firefox 152", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041981"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-57/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-58/"}], "credits": [{"lang": "en", "value": "Haruka Yamazaki"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-06-16T11:52:31.879Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T14:30:33.070995Z", "id": "CVE-2026-12298", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:30:35.362Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-12298", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T14:30:33.070995Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:30:29.962Z"}}], "cna": {"title": "Memory safety bug fixed in Firefox 152", "credits": [{"lang": "en", "value": "Haruka Yamazaki"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "140.12", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "152", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041981"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-57/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-58/"}], "descriptions": [{"lang": "en", "value": "Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.", "supportingMedia": [{"type": "text/html", "value": "Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-06-16T11:52:31.879Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12298", "state": "PUBLISHED", "dateUpdated": "2026-06-16T14:30:35.362Z", "dateReserved": "2026-06-15T15:08:09.561Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2026-06-16T11:52:31.879Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}