CVE-2026-12317

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Jun 16, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1231784.5An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to tCVE-2026-1231795.5An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allCVE-2026-123187.3Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231808.8A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi neCVE-2026-1231815.5A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with adminisCVE-2026-1231835.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCoCVE-2026-1231848.1An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a projecCVE-2026-123196.5Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231968.1Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hostCVE-2026-1231975.3WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted stCVE-2026-1231989.8LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticatedCVE-2026-1231995.5eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded
CVE-2026-12317: High severity, CVSS 7.5 | Vulnix