CVE-2026-12290
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152
CVSS
8.1
High
EPSS
0.4%
p32
KEV
—
Exploit Today
10
0-100
Published: Jun 16, 2026 · Last modified: Jul 15, 2026 · CWE-119 · CWE-823
0.4%EPSS · 30 days0.4%
2026-06-302026-07-26
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2024852
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-57/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-58/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-59/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-60/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-61/
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:27717
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:27733
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:27734
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:29940
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:30846
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:33445
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36100
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36101
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36102
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36103
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:37210
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:37391
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:38506
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:38750
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-175123.3 LOW—
———A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance.8hCVE-2026-497457.8 HIG1.5%
——0Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.3dCVE-2026-497447.8 HIG1.5%
——0Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.3dCVE-2026-164129.8 CRI25.8%
——8Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.4dCVE-2026-164119.8 CRI23.9%
——7Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.4dCVE-2026-163939.1 CRI22.1%
——7Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.4d