CVE-2026-12330

Description

Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

Mozilla / Firefox115.37 – 115.*
Mozilla / Firefox140.12 – *
Mozilla / Thunderbird140.12 – *

References

MISChttps://bugzilla.mozilla.org/show_bug.cgi?id=2029326
VENDOR_ADVISORYhttps://www.mozilla.org/security/advisories/mfsa2026-58/
VENDOR_ADVISORYhttps://www.mozilla.org/security/advisories/mfsa2026-59/
VENDOR_ADVISORYhttps://www.mozilla.org/security/advisories/mfsa2026-61/