CVE-2026-110247

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.

Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment. (CVE-2026-118174) Content of other messages could be included when replying to a crafted message. (CVE-2026-118175) Bypass of remote UNC path restriction in mailbox: URLs. (CVE-2026-118176) Calendar discovery accepted local file and remote network share locations. (CVE-2026-118177) RSS feed could redirect its subscription to a local file or network share. (CVE-2026-118178) Request forgery via news: links. (CVE-2026-118179) Matrix homeserver could redirect the chat session to a local file or network share. (CVE-2026-118180) Integer overflow in libmime buffer growth could lead to heap corruption. (CVE-2026-110247) Use-after-free in S/MIME decryption during a security device password prompt. (CVE-2026-113869) Same-origin policy bypass in the DOM: Navigation component. (CVE-2026-117860) Sandbox escape in the DOM: Navigation component. (CVE-2026-117861) Privilege escalation due to incorrect boundary conditions in the Networking component. (CVE-2026-117862) Information disclosure due to uninitialized memory in the Audio/Video component. (CVE-2026-117863) Sandbox escape in the Form Manager component. (CVE-2026-117864) Use-after-free in the JavaScript: GC component. (CVE-2026-117865) Privilege escalation due to use-after-free in the Graphics: Canvas2D component. (CVE-2026-117866) Use-after-free in the Layout component. (CVE-2026-117867) Sandbox escape in the DOM: Networking component. (CVE-2026-117868) Use-after-free in the DOM: Core & HTML component. (CVE-2026-117869) Use-after-free in the JavaScript Engine component. (CVE-2026-117870) Invalid pointer in the Graphics component. (CVE-2026-117871) Use-after-free in the JavaScript: Standard Library component. (CVE-2026-117872) Incorrect boundary conditions in the Audio/Video: Playback component. (CVE-2026-117873) Use-after-free in the Internationalization component. (CVE-2026-117874) Use-after-free in the Layout: Scrolling and Overflow component. (CVE-2026-117875) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-117876) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-117877) Other issue, use-after-free in the Storage: IndexedDB component. (CVE-2026-117878) Incorrect boundary conditions in the Layout: Tables component. (CVE-2026-117879) Use-after-free in the XML component. (CVE-2026-117880) Use-after-free in the DOM: Core & HTML component. (CVE-2026-117881) Use-after-free in the Layout component. (CVE-2026-117882) Use-after-free in the DOM: HTML Parser component. (CVE-2026-117883) Use-after-free in the Networking component. (CVE-2026-117884) Use-after-free in the Layout: Grid component. (CVE-2026-117885) Incorrect boundary conditions in the Graphics: Text component. (CVE-2026-117886) Use-after-free in the DOM: Core & HTML component. (CVE-2026-117887) Uninitialized memory in the Graphics: Canvas2D component. (CVE-2026-117888) Incorrect boundary conditions in the JavaScript Engine component. (CVE-2026-117889) JIT miscompilation in the JavaScript Engine: JIT component. (CVE-2026-117890) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-117891) Privilege escalation due to use-after-free in the WebRTC: Networking component. (CVE-2026-117892) Incorrect boundary conditions in the Security: PSM component. (CVE-2026-117893) Incorrect boundary conditions in the WebRTC: Signaling component. (CVE-2026-117894) Use-after-free in the DOM: Core & HTML component. (CVE-2026-117895) Use-after-free in the DOM: Core & HTML component. (CVE-2026-117896) Incorrect boundary conditions in the Layout: Tables component. (CVE-2026-117897) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-117898) Use-after-free in the Networking: HTTP component. (CVE-2026-117899) Use-after-free in the DOM: Editor component. (CVE-2026-117900) Use-after-free in the DOM: Core & HTML component. (CVE-2026-117901) Use-after-free in the Layout: Text and Fonts component.…

These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.