Vulnerability Details CVE-2026-12329
Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 23.2%
CVSS Severity
CVSS v3 Score 5.3
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2044738
- https://www.mozilla.org/security/advisories/mfsa2026-58/
- https://www.mozilla.org/security/advisories/mfsa2026-61/
- https://access.redhat.com/errata/RHSA-2026:27717
- https://access.redhat.com/errata/RHSA-2026:27733
- https://access.redhat.com/errata/RHSA-2026:27734
- https://access.redhat.com/errata/RHSA-2026:29940
- https://access.redhat.com/errata/RHSA-2026:30846
- https://access.redhat.com/errata/RHSA-2026:33445
- https://access.redhat.com/errata/RHSA-2026:36100
- https://access.redhat.com/errata/RHSA-2026:36101
- https://access.redhat.com/errata/RHSA-2026:36102
- https://access.redhat.com/errata/RHSA-2026:36103
- https://access.redhat.com/security/cve/CVE-2026-12329
- https://bugzilla.redhat.com/show_bug.cgi?id=2489214
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12329.json
Products affected by CVE-2026-12329
-
cpe:2.3:a:mozilla:thunderbird:140.0
-
cpe:2.3:a:mozilla:thunderbird:140.0.1
-
cpe:2.3:a:mozilla:thunderbird:140.1.0
-
cpe:2.3:a:mozilla:thunderbird:140.1.1
-
cpe:2.3:a:mozilla:thunderbird:140.10.1
-
cpe:2.3:a:mozilla:thunderbird:140.2.0
-
cpe:2.3:a:mozilla:thunderbird:140.2.1
-
cpe:2.3:a:mozilla:thunderbird:140.3.0
-
cpe:2.3:a:mozilla:thunderbird:140.3.1
-
cpe:2.3:a:mozilla:thunderbird:140.4.0
-
cpe:2.3:a:mozilla:thunderbird:140.5.0
-
cpe:2.3:a:mozilla:thunderbird:140.6.0
-
cpe:2.3:a:mozilla:thunderbird:140.7.0
-
cpe:2.3:a:mozilla:thunderbird:140.8.1
-
cpe:2.3:a:mozilla:thunderbird:140.9.0
-
cpe:2.3:a:mozilla:thunderbird:140.9.1