CVE-2026-12329

Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.

Score

CVSS 3.1 7.5 High

Status

Modified - security@mozilla.org

Published

2026-06-16

Last modified

2026-10-25

Weaknesses

CWE-119, CWE-416, CWE-476

Affected products

• Firefox (Mozilla)
• Thunderbird (Mozilla)
• Enterprise Linux (Redhat)
• Enterprise Linux Eus (Redhat)
• Rhel Aus (Redhat)
• Rhel E4s (Redhat)
• Rhel Els (Redhat)
• Rhel Eus (Redhat)
• Rhel Eus Long Life (Redhat)
• Rhel Tus (Redhat)

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2044738
• https://www.mozilla.org/security/advisories/mfsa2026-58/
• https://www.mozilla.org/security/advisories/mfsa2026-61/
• https://access.redhat.com/security/cve/CVE-2026-12329
• https://bugzilla.redhat.com/show_bug.cgi?id=2489214
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12329.json
• https://access.redhat.com/errata/RHSA-2026:38506
• https://access.redhat.com/errata/RHSA-2026:36100
• https://access.redhat.com/errata/RHSA-2026:38751
• https://access.redhat.com/errata/RHSA-2026:27733
• https://access.redhat.com/errata/RHSA-2026:30846
• https://access.redhat.com/errata/RHSA-2026:27717
• https://access.redhat.com/errata/RHSA-2026:33445
• https://access.redhat.com/errata/RHSA-2026:36102
• https://access.redhat.com/errata/RHSA-2026:39428
• https://access.redhat.com/errata/RHSA-2026:37210
• https://access.redhat.com/errata/RHSA-2026:39141
• https://access.redhat.com/errata/RHSA-2026:36103
• https://access.redhat.com/errata/RHSA-2026:39142
• https://access.redhat.com/errata/RHSA-2026:36101
• https://access.redhat.com/errata/RHSA-2026:39706
• https://access.redhat.com/errata/RHSA-2026:39011
• https://access.redhat.com/errata/RHSA-2026:38753
• https://access.redhat.com/errata/RHSA-2026:37391
• https://access.redhat.com/errata/RHSA-2026:38750
• https://access.redhat.com/errata/RHSA-2026:27734
• https://access.redhat.com/errata/RHSA-2026:29940