Skip to content
Fencer Vulns
high 8.8

CVE-2018-12406 json

Mozilla developers and community members reported memory safety bugs present in Firefox 63.

published 2019-02-28 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-4380

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64.

Patch / fix

  • Mozilla Firefox 64
  • firefox Ubuntu 14.04 LTS 64.0+build3-0ubuntu0.14.04.1
  • firefox Ubuntu 16.04 LTS 64.0+build3-0ubuntu0.16.04.1
  • firefox Ubuntu 18.04 LTS 64.0+build3-0ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2018-12406

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1

  • firefox Arch Linux 64.0-1

arch linux advisories AVG-833

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12406 updated cvss 8.8

firefox: memory safety bugs showing evidence of memory corruption leading to run arbitrary code

  • Red Hat Enterprise Linux 5 firefox Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 firefox
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • mozilla.org https://www.mozilla.org/security/advisories/mfsa2018-29/ referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.mozilla.org https://bugzilla.mozilla.org/buglist.cgi?bug_id=1456947%2C1475669%2C1504816%2C1502886%2C1500064%2C1500310%2C1500696%2C1499198%2C1434490%2C1481745%2C1458129 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Mozilla Firefox

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.