Every CVE Search/ Get API key

CVE-2026-14899

Off-by-one out of bounds read in MIME header parser for forwarding

7.5 HighFix available

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.47%Up 0.3 points since Jul 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Off-by-one out of bounds read in MIME header parser for forwarding

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Record
CVE-2026-14899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-193
Updated
2026-11-02
EUVDEUVD-2026-47773 7.5

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Record
EUVD-2026-47773
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6667-m7mf-jcr7 7.5

The code to parse MIME headers for display when forwarding a message (if the setting to view all...

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Record
GHSA-6667-m7mf-jcr7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-193
Updated
2026-11-02
NVD 7.5

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Record
CVE-2026-14899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-193
Updated
2026-11-02
OSVDEBIAN-CVE-2026-14899 7.5

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Record
DEBIAN-CVE-2026-14899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3195 9.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.(CVE-2026-14899)

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)

Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)

Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)

Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)

Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed…

Record
OESA-2026-3195
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 23 moreShow less
OSVOESA-2026-3196 9.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.(CVE-2026-14899)

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)

Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)

Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)

Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)

Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed…

Record
OESA-2026-3196
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:49621 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:49621
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:49921 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:49921
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:49922 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:49922
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53444 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53444
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53445 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53445
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53446 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53446
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53453 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53453
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53454 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53454
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53455 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53455
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53475 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:53475
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:49621 8.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)

  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)

  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)

  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)

  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)

  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

  • thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49621
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:49921 8.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)

  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)

  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)

  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)

  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)

  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

  • thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49921
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:49922 8.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)

  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)

  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)

  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)

  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)

  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

  • thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49922
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-14899 7.5

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Record
UBUNTU-CVE-2026-14899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:49621 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
  • thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49621
Updated
2026-11-02
OSVALSA-2026:49921 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
  • thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49921
Updated
2026-11-02
OSVALSA-2026:49922 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
  • thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49922
Updated
2026-11-02
OSVCLSA-2026-1785839724 No score

thunderbird: Fix of 35 CVEs

  • update to 140.13.0 ESR (MFSA 2026-72; includes MFSA 2026-64 / 140.12.1 fixes)
  • CVE-2026-14899: The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird
  • CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component. Exploit code for this issue is public
  • CVE-2026-15719: Site isolation issue in the DOM: Navigation component. Exploit code for this issue is public
  • CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
  • CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
  • CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component
  • CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component
  • CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component
  • CVE-2026-16354: Information disclosure in the Graphics: ImageLib component
  • CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component
  • CVE-2026-16357: Incorrect boundary conditions in the Graphics component
  • CVE-2026-16358: Site isolation issue in the Graphics: WebRender component
  • CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component
  • CVE-2026-16360: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code
  • CVE-2026-16361: Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code
  • CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
  • CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component
  • CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component
  • CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component
  • CVE-2026-16371: Privilege escalation in the DOM: Navigation component
  • CVE-2026-16374: Information disclosure in the Framework component in DevTools
  • CVE-2026-16375: Site isolation issue in the Networking: HTTP component
  • CVE-2026-16377: Mitigation bypass in the PDF Viewer component
  • CVE-2026-16379: Privilege escalation in the DOM: Content Processes component
  • CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component
  • CVE-2026-16383: Mitigation bypass in the DOM: Networking component
  • CVE-2026-16387: Site isolation issue in the Networking component
  • CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
  • CVE-2026-16391: Information disclosure in the Storage: IndexedDB component
  • CVE-2026-16396: Privilege escalation in WebExtensions
  • CVE-2026-16405: Information disclosure in the Networking: WebSockets component
  • CVE-2026-16412: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code
  • CVE-2026-57962: Memory exhaustion via a malicious LDAP address-book server
  • CVE-2026-57963: Content injection via HTML chat messages (Matrix/XMPP)
Record
CLSA-2026-1785839724
Updated
2026-11-02
OSVMGASA-2026-0326 No score

Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix various security issues. See the links to get complete information of each issue.

Record
MGASA-2026-0326
Updated
2026-11-02
OSVopenSUSE-SU-2026:11359-1 No score

MozillaThunderbird-140.13.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11359-1
Updated
2026-11-02
OSVSUSE-SU-2026:3546-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 140.13.

  • MFSA 2026-72 (bsc#1271649)
    • CVE-2026-14899: Off-by-one out of bounds read in MIME header parser for forwarding
    • CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
    • CVE-2026-15719: Site isolation issue in the DOM: Navigation component
    • CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
    • CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
    • CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
    • CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component
    • CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component
    • CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component
    • CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component
    • CVE-2026-16354: Information disclosure in the Graphics: ImageLib component
    • CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component
    • CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component
    • CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component
    • CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component
    • CVE-2026-16357: Incorrect boundary conditions in the Graphics component
    • CVE-2026-16371: Privilege escalation in the DOM: Navigation component
    • CVE-2026-16374: Information disclosure in the Framework component in DevTools
    • CVE-2026-16375: Site isolation issue in the Networking: HTTP component
    • CVE-2026-16377: Mitigation bypass in the PDF Viewer component
    • CVE-2026-16379: Privilege escalation in the DOM: Content Processes component
    • CVE-2026-16358: Site isolation issue in the Graphics: WebRender component
    • CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component
    • CVE-2026-16383: Mitigation bypass in the DOM: Networking component
    • CVE-2026-16387: Site isolation issue in the Networking component
    • CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
    • CVE-2026-16391: Information disclosure in the Storage: IndexedDB component
    • CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component
    • CVE-2026-16396: Privilege escalation in WebExtensions
    • CVE-2026-16405: Information disclosure in the Networking: WebSockets component
    • CVE-2026-16412: Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
    • CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
    • CVE-2026-16361: Memory safety bugs fixed in Thunderbird ESR 140.13
Record
SUSE-SU-2026:3546-1
Updated
2026-11-02
OSVSUSE-SU-2026:4268-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird 153.2:

  • fixed: Deleting an Exchange account retained the outgoing server settings
  • fixed: Thunderbird upgrade disabled Settings menu for versions before macOS 13
  • fixed: Windows jump list menu no longer functioned correctly
  • fixed: Security fixes MFSA 2026-88 (bsc#1278001):
  • CVE-2026-84639 Uninitialized memory in MIME parsing
  • CVE-2026-84640 One byte overflow read in mail parser
  • CVE-2026-84641 Information disclosure due to malicious IMAP server response
  • CVE-2026-84637 Calendar invitation attachments could launch local executables
  • CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression
  • CVE-2026-75874 Sandbox escape in the Remote Settings Client component
  • CVE-2026-84118 Use-after-free in the JavaScript: GC component
  • CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component
  • CVE-2026-84120 Use-after-free in the Audio/Video component
  • CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component
  • CVE-2026-84122 Use-after-free in the Audio/Video component
  • CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component
  • CVE-2026-84124 Use-after-free in the DOM: Core & HTML component
  • CVE-2026-84125 Use-after-free in the DOM: Core & HTML component
  • CVE-2026-74952 Privilege escalation in the Application Update component
  • CVE-2026-84129 Site isolation issue in the DOM: Navigation component
  • CVE-2026-84130 Information disclosure in the Graphics: WebGPU component
  • CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component
  • CVE-2026-84132 Information disclosure in the Networking: HTTP component
  • CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component
  • CVE-2026-84134 Other issue in the Profile Backup component
  • CVE-2026-84136 Other issue in the DOM: Navigation component
  • CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component
  • CVE-2026-84139 Clickjacking issue in the DOM: Events component
  • CVE-2026-84140 Site isolation issue in the DOM: Navigation component
  • CVE-2026-84141 Integer overflow in the Graphics: ImageLib component
  • CVE-2026-84143 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
  • CVE-2026-84144 Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2
  • CVE-2026-84145 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15

  • Mozilla Thunderbird 153.1.1

    • fixed: Thunderbird upgrade disabled composition toolbar
    • fixed: Draft was not preserved when encrypted message send failed
    • fixed: Account Hub prompted for calendar credentials after successful login
    • fixed: Thunderbird crash fixes
    • fixed: Folder compaction showed incorrect disk space recovery estimates
    • fixed: Thunderbird failed to launch GPU process

  • Mozilla Thunderbird 153.1

    • fixed: Autoscroll icon was missing directional arrows in scrollable messages
    • fixed: Security fixes MFSA 2026-80 (bsc#1274867):
    • CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
    • CVE-2026-74935 Privilege escalation in the DOM: Networking component
    • CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
    • CVE-2026-74937 Use-after-free in the JavaScript: GC component
    • CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
    • CVE-2026-74939 Privilege escalation in the DOM: Navigation component
    • CVE-2026-74940 Use-after-free in the Graphics: Text component
    • CVE-2026-74941 Privilege escalation in the Graphics:…
Record
SUSE-SU-2026:4268-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
thunderbird
AlmaLinux:10
 before 140.13.0-1.el10_2.alma.1
140.13.0-1.el10_2.alma.1
thunderbird
AlmaLinux:9
 before 140.13.0-1.el9_8.alma.1
140.13.0-1.el9_8.alma.1
thunderbird
AlmaLinux:8
 before 140.13.0-1.el8_10.alma.1
140.13.0-1.el8_10.alma.1
thunderbird
TuxCare:AlmaLinux:9.2
 before 140.13.0-1.el9_2.alma.1.tuxcare.els1
140.13.0-1.el9_2.alma.1.tuxcare.els1
thunderbird
Debian:12
 before 1:140.13.0esr-2~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.13.0esr-2~deb12u1
thunderbird
Debian:13
 before 1:140.13.0esr-2~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-11:140.5.0esr-1~deb11u1
1:140.13.0esr-2~deb13u1
thunderbird
Debian:14
 before 1:140.13.0esr-1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u11:140.5.0esr-1~deb13u11:140.6.0esr-1
1:140.13.0esr-1
thunderbird
Mageia:10
 before 140.13.0-1.mga10
140.13.0-1.mga10
thunderbird-l10n
Mageia:10
 before 140.13.0-1.mga10
140.13.0-1.mga10
thunderbird
Mageia:9
 before 140.13.0-1.mga9
140.13.0-1.mga9
Show 54 moreShow less
Affected packages
PackageAffectedFixed
thunderbird-l10n
Mageia:9
 before 140.13.0-1.mga9
140.13.0-1.mga9
thunderbird
openEuler:24.03-LTS-SP4
 before 140.13.0-1.oe2403sp4
140.13.0-1.oe2403sp4
thunderbird
openEuler:24.03-LTS-SP3
 before 140.13.0-1.oe2403sp3
140.13.0-1.oe2403sp3
thunderbird
Red Hat:enterprise_linux:10.2
 before 0:140.13.0-1.el10_2
0:140.13.0-1.el10_2
thunderbird-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:140.13.0-1.el10_2
0:140.13.0-1.el10_2
thunderbird-debugsource
Red Hat:enterprise_linux:10.2
 before 0:140.13.0-1.el10_2
0:140.13.0-1.el10_2
thunderbird
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
thunderbird
Red Hat:enterprise_linux:8::appstream
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
thunderbird
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
thunderbird-debuginfo
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
thunderbird-debugsource
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
thunderbird
Red Hat:enterprise_linux_eus:10.0
 before 0:140.13.0-1.el10_0
0:140.13.0-1.el10_0
thunderbird-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:140.13.0-1.el10_0
0:140.13.0-1.el10_0
thunderbird-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:140.13.0-1.el10_0
0:140.13.0-1.el10_0
thunderbird
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
thunderbird-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
thunderbird-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
thunderbird
Red Hat:rhel_aus:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
thunderbird
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
thunderbird
Red Hat:rhel_e4s:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_e4s:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_e4s:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
thunderbird
Red Hat:rhel_tus:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_tus:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_tus:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
thunderbird
Red Hat:rhel_aus:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
thunderbird
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
thunderbird
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
thunderbird-debuginfo
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
thunderbird-debugsource
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
thunderbird
Rocky Linux:10
 before 0:140.13.0-1.el10_2
0:140.13.0-1.el10_2
thunderbird
Rocky Linux:9
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
thunderbird
Rocky Linux:8
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 140.13.0-150200.8.280.1
140.13.0-150200.8.280.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP7
 before 140.13.0-150200.8.280.1
140.13.0-150200.8.280.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 153.2.0-150400.13.3.1
153.2.0-150400.13.3.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP7
 before 153.2.0-150400.13.3.1
153.2.0-150400.13.3.1
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
thunderbird
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:115.3.1+build1-0ubuntu11:115.4.1+build1-0ubuntu11:115.4.3+build1-0ubuntu11:115.5.0+build1-0ubuntu11:115.5.1+build1-0ubuntu1
Show 9 moreShow less
1:115.5.2+build2-0ubuntu11:115.6.0+build1-0ubuntu11:115.6.0+build2-0ubuntu11:115.6.1+build1-0ubuntu11:115.8.0+build1-0ubuntu11:115.8.1+build1+snap21:115.8.1+build1+snap32:1snap1-0ubuntu12:1snap1-0ubuntu3
 None known
thunderbird
Ubuntu:26.10
 All versions, plus listed versions
2:1snap1-0ubuntu5
 None known
thunderbird
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:1snap1-0ubuntu32:1snap1-0ubuntu42:1snap1-0ubuntu5
 None known
MozillaThunderbird
openSUSE:Tumbleweed
 before 140.13.0-1.1
140.13.0-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14899 is a high vulnerability (CVSS 7.5) in Mozilla Thunderbird, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in thunderbird 140.13.0-1.el10_2.alma.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 219 versions, 167 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open