PT-2026-49698 · Mozilla+1 · Thunderbird+2

Michael Froman

·

CVE-2026-12329

·

Published

2026-06-16

·

Updated

2026-08-03

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.12 Firefox ESR versions prior to 140.12
Description A memory safety bug exists in the software, which could lead to instability or unexpected behavior when handling memory operations.
Recommendations Update to version 140.12 for Thunderbird. Update to version 140.12 for Firefox ESR.

Fix

DoS

Buffer Overflow

Use After Free

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-119CWE-416CWE-476

Related Identifiers

ALSA-2026:27717
ALSA-2026:27733
ALSA-2026:27734
ALSA-2026:29940
ALSA-2026:30846
ALSA-2026:33445
CVE-2026-12329
OESA-2026-2735
OESA-2026-2736
OESA-2026-2737
OESA-2026-2756
OPENSUSE-SU-2026:11055-1
OPENSUSE-SU-2026:11072-1
OPENSUSE-SU-2026:21043-1
OPENSUSE-SU-2026:21168-1
OPENSUSE-SU-2026:21519-1
RHSA-2026:33445
SUSE-SU-2026:22351-1
SUSE-SU-2026:23115-1
SUSE-SU-2026:23137-1
SUSE-SU-2026:2582-1
SUSE-SU-2026:2583-1
SUSE-SU-2026:2814-1
SUSE-SU-2026:2852-1

Affected Products

Firefox Esr
Rocky Linux
Thunderbird