CVE Vulnerabilities

CVE-2026-12321

Always-Incorrect Control Flow Implementation

Published: Jun 16, 2026 | Modified: Jun 17, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
3.4 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Ubuntu
MEDIUM
root.io logo minimus.io logo echo.ai logo

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Weakness

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Affected Software

NameVendorStart VersionEnd Version
FirefoxMozilla*152.0.0 (excluding)
ThunderbirdMozilla*152.0.0 (excluding)
Mozjs102Ubuntuesm-apps/noble*
Mozjs102Ubuntujammy*
Mozjs102Ubuntunoble*
Mozjs115Ubuntunoble*
Mozjs52Ubuntuesm-apps/focal*
Mozjs52Ubuntuesm-infra/bionic*
Mozjs68Ubuntuesm-infra/focal*
Mozjs78Ubuntuesm-apps/jammy*
Mozjs78Ubuntujammy*
Mozjs91Ubuntujammy*
ThunderbirdUbuntujammy*

References