CVE-2026-110249
Denial-of-service in the Exchange email component
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial-of-service in the Exchange email component
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
- Record
CVE-2026-110249- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-99208
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
- Record
EUVD-2026-99208- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3vgg-r2jh-qqpj
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP...
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
- Record
GHSA-3vgg-r2jh-qqpj- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
- Record
CVE-2026-110249- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-110249
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
- Record
DEBIAN-CVE-2026-110249- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-110249
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
- Record
UBUNTU-CVE-2026-110249- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1792779937 No score
thunderbird: Fix of 56 CVEs
- update to 153.5.0 ESR (MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5)
- drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0
- stop packaging rnp-cli and rnpkeys: upstream no longer installs them (bug 2068130); librnp.so is still shipped
- regenerate langpacks from the 153.5.0esr release xpi set (66 languages, the same set as 153.3.1esr)
- CVE-2026-103500: Heap buffer overflow opening large email
- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-100757: Use-after-free in the Widget component
- CVE-2026-100758: Sandbox escape in the DOM: Navigation component
- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component
- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component
- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component
- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100766: Information disclosure in the Networking: JAR component
- CVE-2026-100767: Use-after-free in the Networking: Cache component
- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component
- CVE-2026-100771: Undefined behavior in the DOM: Streams component
- CVE-2026-100772: Use-after-free in the DOM: Core & HTML component
- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component
- CVE-2026-100774: Use-after-free in the DOM: Core & HTML component
- CVE-2026-100775: Sandbox escape in the Graphics component
- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component
- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component
- CVE-2026-100779: Use-after-free in the XSLT component
- CVE-2026-100780: Use-after-free in the DOM: Core & HTML component
- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component
- CVE-2026-100783: Uninitialized memory in the Audio/Video component
- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component
- CVE-2026-100785: Use-after-free in the DOM: Core & HTML component
- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component
- CVE-2026-100787: Sandbox escape in the XUL component
- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component
- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component
- CVE-2026-100790: Use-after-free in the XSLT component
- CVE-2026-100791: Use-after-free in the DOM: Core & HTML component
- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component
- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component
- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component
- CVE-2026-96869: Information disclosure in the Networking component
- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component
- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component
- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-100801: Privilege escalation in the DLL Services component
- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component
- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component
- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component
- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component
- CVE-2026-100809: Same-origin policy bypass in the DevTools component
- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component
- CVE-2026-100812:…
- Record
CLSA-2026-1792779937- Updated
- 2026-11-02
OSVMGASA-2026-0523 No score
Updated thunderbird packages fix security vulnerabilities
Denial-of-service in the Exchange email component. (CVE-2026-110249) Privilege escalation in the Application Update component. (CVE-2026-109704) Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. (CVE-2026-109705) Use-after-free in the Storage: IndexedDB component. (CVE-2026-109706) Sandbox escape due to use-after-free in the Networking component. (CVE-2026-109707) Sandbox escape due to incorrect boundary conditions in the Networking component. (CVE-2026-109708) Information disclosure, privilege escalation in the Security: Process Sandboxing component. (CVE-2026-109709) Use-after-free in the Graphics: Text component. (CVE-2026-109710) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-109711) Sandbox escape due to uninitialized memory in the Graphics component. (CVE-2026-109712) Use-after-free in the Crash Reporting component. (CVE-2026-109713) Incorrect boundary conditions in the JavaScript Engine component. (CVE-2026-109715) Incorrect boundary conditions in the JavaScript Engine component. (CVE-2026-109716) Use-after-free in the DOM: Bindings (WebIDL) component. (CVE-2026-109717) Use-after-free in the XML component. (CVE-2026-109718) Race condition, use-after-free in the Graphics: CanvasWebGL component. (CVE-2026-109719) JIT miscompilation in the JavaScript: WebAssembly component. (CVE-2026-109720) Incorrect boundary conditions in the JavaScript Engine: JIT component. (CVE-2026-109721) JIT miscompilation in the JavaScript Engine: JIT component. (CVE-2026-109722) Integer overflow in the Layout: Text and Fonts component. (CVE-2026-109723) Use-after-free in the DOM: Core & HTML component. (CVE-2026-109724) Use-after-free in the DOM: Core & HTML component. (CVE-2026-109725) Use-after-free in the SVG component. (CVE-2026-109726) Use-after-free in the Audio/Video component. (CVE-2026-109727) Use-after-free in the DOM: Animation component. (CVE-2026-109728) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-109729) Integer overflow in the Graphics component. (CVE-2026-109730) Incorrect boundary conditions in the Graphics: Canvas2D component. (CVE-2026-109731) Use-after-free in the DOM: Streams component. (CVE-2026-109732) JIT miscompilation in the JavaScript Engine: JIT component. (CVE-2026-109733) Mitigation bypass in the DOM: Security component. (CVE-2026-109734) Frame poisoning in the Layout component. (CVE-2026-109736) Mitigation bypass in the Enterprise Policies component. (CVE-2026-109737) Use-after-free in the Audio/Video: Playback component. (CVE-2026-109738) Use-after-free in the Storage: Bucket File System component. (CVE-2026-109741) Information disclosure in the PDF Viewer component. (CVE-2026-109742) Privilege escalation in the Panning and Zooming component. (CVE-2026-109743) Other issue in the DOM: File component. (CVE-2026-109744) Sandbox escape due to uninitialized memory in the DOM: Web Serial component. (CVE-2026-109745) Mitigation bypass in the File Handling component. (CVE-2026-109782) Information disclosure in the Networking component. (CVE-2026-109751) Use-after-free in the DOM: Workers component. (CVE-2026-109752) Incorrect boundary conditions in the Layout component. (CVE-2026-109753) Incorrect boundary conditions in the DOM: Editor component. (CVE-2026-109754) Privilege escalation in the DOM: Navigation component. (CVE-2026-109756) Sandbox escape due to race condition in the Networking component. (CVE-2026-109757) Site isolation issue in the Networking component. (CVE-2026-109759) Mitigation bypass in the Networking: HTTP component. (CVE-2026-109760) Incorrect boundary conditions in the SVG component. (CVE-2026-109762) Mitigation bypass in the File Handling component. (CVE-2026-109763) Mitigation bypass in the Enterprise Policies component. (CVE-2026-109764) Race condition, use-after-free in the Graphics: Text component. (CVE-2026-109765) Mitigation bypass in the Enterprise Policies component. (CVE-2026-109766)…
- Record
MGASA-2026-0523- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12224-1 No score
MozillaThunderbird-153.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-153.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12224-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4736-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):
- CVE-2026-109704: Privilege escalation in the Application Update component.
- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.
- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.
- CVE-2026-109710: Use-after-free in the Graphics: Text component.
- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
- CVE-2026-109713: Use-after-free in the Crash Reporting component.
- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
- CVE-2026-109718: Use-after-free in the XML component.
- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
- CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-109726: Use-after-free in the SVG component.
- CVE-2026-109727: Use-after-free in the Audio/Video component.
- CVE-2026-109728: Use-after-free in the DOM: Animation component.
- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
- CVE-2026-109730: Integer overflow in the Graphics component.
- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
- CVE-2026-109732: Use-after-free in the DOM: Streams component.
- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
- CVE-2026-109734: Mitigation bypass in the DOM: Security component.
- CVE-2026-109736: Frame poisoning in the Layout component.
- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
- CVE-2026-109742: Information disclosure in the PDF Viewer component.
- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
- CVE-2026-109744: Other issue in the DOM: File component.
- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
- CVE-2026-109751: Information disclosure in the Networking component.
- CVE-2026-109752: Use-after-free in the DOM: Workers component.
- CVE-2026-109753: Incorrect boundary conditions in the Layout component.
- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
- CVE-2026-109759: Site isolation issue in the Networking component.
- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
- CVE-2026-109762: Incorrect boundary conditions in the SVG component.
- CVE-2026-109763: Mitigation bypass in the File Handling component.
- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component. -…
- Record
SUSE-SU-2026:4736-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdTuxCare:AlmaLinux:9.2 From an advisory covering 125 CVEs |
before 153.5.0-1.el9_2.alma.1.tuxcare.els1 | 153.5.0-1.el9_2.alma.1.tuxcare.els1 |
thunderbirdDebian:12 |
before 1:153.5.1esr-1~deb12u1, plus listed versions 1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1 Show 45 moreShow less1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1 |
1:153.5.1esr-1~deb12u1 |
thunderbirdDebian:13 |
before 1:153.5.1esr-1~deb13u1, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1 |
1:153.5.1esr-1~deb13u1 |
thunderbirdDebian:14 |
before 1:153.5.0esr-1, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1 |
1:153.5.0esr-1 |
thunderbird-l10nMageia:10 From an advisory covering 62 CVEs |
before 153.5.0-1.mga10 | 153.5.0-1.mga10 |
thunderbirdMageia:10 From an advisory covering 62 CVEs |
before 153.5.0-1.mga10 | 153.5.0-1.mga10 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 86 CVEs |
before 153.5.0-150400.13.9.1 | 153.5.0-150400.13.9.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 86 CVEs |
before 153.5.0-150400.13.9.1 | 153.5.0-150400.13.9.1 |
thunderbirdUbuntu:22.04:LTS |
All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1 |
None known |
thunderbirdUbuntu:24.04:LTS |
All versions, plus listed versions 1:115.3.1+build1-0ubuntu11:115.4.1+build1-0ubuntu11:115.4.3+build1-0ubuntu11:115.5.0+build1-0ubuntu11:115.5.1+build1-0ubuntu1 Show 9 moreShow less1:115.5.2+build2-0ubuntu11:115.6.0+build1-0ubuntu11:115.6.0+build2-0ubuntu11:115.6.1+build1-0ubuntu11:115.8.0+build1-0ubuntu11:115.8.1+build1+snap21:115.8.1+build1+snap32:1snap1-0ubuntu12:1snap1-0ubuntu3 |
None known |
thunderbirdUbuntu:26.10 |
All versions, plus listed versions 2:1snap1-0ubuntu5 |
None known |
thunderbirdUbuntu:26.04:LTS |
All versions, plus listed versions 2:1snap1-0ubuntu32:1snap1-0ubuntu42:1snap1-0ubuntu5 |
None known |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 66 CVEs |
before 153.5.1-1.1 | 153.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-110249 is a high vulnerability (CVSS 8.6) in Mozilla Thunderbird, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in thunderbird 1:153.5.1esr-1~deb12u1.
References
bugzilla.mozilla.org/show_bug.cgi?id=2077826
mozilla.org/security/advisories/mfsa2026-109
nvd.nist.gov/vuln/detail/CVE-2026-110249
github.com/advisories/GHSA-3vgg-r2jh-qqpj
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792779937.html
Show 165 moreShow less
security-tracker.debian.org/tracker/CVE-2026-110249
advisories.mageia.org/MGASA-2026-0523.html
bugs.mageia.org/show_bug.cgi?id=36509
thunderbird.net/en-US/thunderbird/153.5.0esr/releasenotes
suse.com/support/update/announcement/2026/suse-su-20264736-1
bugzilla.suse.com/1259712
ubuntu.com/security/CVE-2026-110249
cve.org/CVERecord?id=CVE-2026-110249
Left out here: 298 versions and the rest of 3 source descriptions. The JSON record has them.