Every CVE Search/ Get API key

CVE-2026-84641

Information disclosure due to malicious IMAP server response

7.5 HighFix available

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.27%Up 0.1 points since Sep 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Information disclosure due to malicious IMAP server response

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Record
CVE-2026-84641
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-69710 7.5

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Record
EUVD-2026-69710
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f2hg-25f8-vgfj 7.5

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a...

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Record
GHSA-f2hg-25f8-vgfj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-416
Updated
2026-11-02
NVD 7.5

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Record
CVE-2026-84641
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-84641 7.5

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Record
DEBIAN-CVE-2026-84641
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3842 9.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84145)

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84639)

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84640)

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84641)

Record
OESA-2026-3842
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 21 moreShow less
OSVOESA-2026-3982 9.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84145)

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84639)

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84640)

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84641)

Record
OESA-2026-3982
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:70642 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:70642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73130 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:73130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73971 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:73971
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:77627 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:77627
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:77631 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:77631
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:77632 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:77632
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80503 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:80503
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81912 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81912
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81913 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81913
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:82122 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:82122
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:70642 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to…

Record
RLSA-2026:70642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:73130 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to…

Record
RLSA-2026:73130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:73971 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to…

Record
RLSA-2026:73971
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-84641 7.5

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Record
UBUNTU-CVE-2026-84641
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:70642 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
  • firefox:…
Record
ALSA-2026:70642
Updated
2026-11-02
OSVALSA-2026:73130 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
  • firefox:…
Record
ALSA-2026:73130
Updated
2026-11-02
OSVALSA-2026:73971 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
  • firefox:…
Record
ALSA-2026:73971
Updated
2026-11-02
OSVMGASA-2026-0388 No score

Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. (CVE-2026-84639) One byte overflow read in mail parser. (CVE-2026-84640) Information disclosure due to malicious IMAP server response. (CVE-2026-84641) Calendar invitation attachments could launch local executables. (CVE-2026-84637) Allowed UNC hostnames for attachments interpreted as a regular expression. (CVE-2026-84642) Sandbox escape in the Remote Settings Client component. (CVE-2026-75874) Privilege escalation in the DOM: Workers component. (CVE-2026-16365) Use-after-free in the JavaScript: GC component. (CVE-2026-84118) Sandbox escape due to use-after-free in the DOM: Navigation component. (CVE-2026-84119) Use-after-free in the Audio/Video component. (CVE-2026-84120) Sandbox escape due to use-after-free in the DOM: Security component. (CVE-2026-84121) Use-after-free in the Audio/Video component. (CVE-2026-84122) Privilege escalation due to use-after-free in the Graphics: WebGPU component. (CVE-2026-84123) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125) Privilege escalation in the DOM: Navigation component. (CVE-2026-16371) Privilege escalation in the Application Update component. (CVE-2026-74952) Site isolation issue in the DOM: Navigation component. (CVE-2026-84129) Information disclosure in the Graphics: WebGPU component. (CVE-2026-84130) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-84131) Information disclosure in the Networking: HTTP component. (CVE-2026-84132) Site isolation issue in the DOM: Push Subscriptions component. (CVE-2026-84133) Other issue in the Profile Backup component. (CVE-2026-84134) Other issue in the DOM: Navigation component. (CVE-2026-84136) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137) Clickjacking issue in the DOM: Events component. (CVE-2026-84139) Site isolation issue in the DOM: Navigation component. (CVE-2026-84140) Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84143) Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2. (CVE-2026-84144) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84145)

Record
MGASA-2026-0388
Updated
2026-11-02
OSVopenSUSE-SU-2026:11678-1 No score

MozillaThunderbird-140.15.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.15.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11678-1
Updated
2026-11-02
OSVSUSE-SU-2026:4268-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird 153.2:

  • fixed: Deleting an Exchange account retained the outgoing server settings
  • fixed: Thunderbird upgrade disabled Settings menu for versions before macOS 13
  • fixed: Windows jump list menu no longer functioned correctly
  • fixed: Security fixes MFSA 2026-88 (bsc#1278001):
  • CVE-2026-84639 Uninitialized memory in MIME parsing
  • CVE-2026-84640 One byte overflow read in mail parser
  • CVE-2026-84641 Information disclosure due to malicious IMAP server response
  • CVE-2026-84637 Calendar invitation attachments could launch local executables
  • CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression
  • CVE-2026-75874 Sandbox escape in the Remote Settings Client component
  • CVE-2026-84118 Use-after-free in the JavaScript: GC component
  • CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component
  • CVE-2026-84120 Use-after-free in the Audio/Video component
  • CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component
  • CVE-2026-84122 Use-after-free in the Audio/Video component
  • CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component
  • CVE-2026-84124 Use-after-free in the DOM: Core & HTML component
  • CVE-2026-84125 Use-after-free in the DOM: Core & HTML component
  • CVE-2026-74952 Privilege escalation in the Application Update component
  • CVE-2026-84129 Site isolation issue in the DOM: Navigation component
  • CVE-2026-84130 Information disclosure in the Graphics: WebGPU component
  • CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component
  • CVE-2026-84132 Information disclosure in the Networking: HTTP component
  • CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component
  • CVE-2026-84134 Other issue in the Profile Backup component
  • CVE-2026-84136 Other issue in the DOM: Navigation component
  • CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component
  • CVE-2026-84139 Clickjacking issue in the DOM: Events component
  • CVE-2026-84140 Site isolation issue in the DOM: Navigation component
  • CVE-2026-84141 Integer overflow in the Graphics: ImageLib component
  • CVE-2026-84143 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
  • CVE-2026-84144 Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2
  • CVE-2026-84145 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15

  • Mozilla Thunderbird 153.1.1

    • fixed: Thunderbird upgrade disabled composition toolbar
    • fixed: Draft was not preserved when encrypted message send failed
    • fixed: Account Hub prompted for calendar credentials after successful login
    • fixed: Thunderbird crash fixes
    • fixed: Folder compaction showed incorrect disk space recovery estimates
    • fixed: Thunderbird failed to launch GPU process

  • Mozilla Thunderbird 153.1

    • fixed: Autoscroll icon was missing directional arrows in scrollable messages
    • fixed: Security fixes MFSA 2026-80 (bsc#1274867):
    • CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
    • CVE-2026-74935 Privilege escalation in the DOM: Networking component
    • CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
    • CVE-2026-74937 Use-after-free in the JavaScript: GC component
    • CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
    • CVE-2026-74939 Privilege escalation in the DOM: Navigation component
    • CVE-2026-74940 Use-after-free in the Graphics: Text component
    • CVE-2026-74941 Privilege escalation in the Graphics:…
Record
SUSE-SU-2026:4268-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
thunderbird
AlmaLinux:9
From an advisory covering 44 CVEs
 before 140.16.0-1.el9_8.alma.1
140.16.0-1.el9_8.alma.1
thunderbird
AlmaLinux:10
From an advisory covering 44 CVEs
 before 140.16.0-1.el10_2.alma.1
140.16.0-1.el10_2.alma.1
thunderbird
AlmaLinux:8
From an advisory covering 44 CVEs
 before 140.16.0-1.el8_10.alma.1
140.16.0-1.el8_10.alma.1
thunderbird
Debian:12
 before 1:140.15.0esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.15.0esr-1~deb12u1
thunderbird
Debian:13
 before 1:140.15.0esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u1
1:140.15.0esr-1~deb13u1
thunderbird
Debian:14
 before 1:153.2.0esr-1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1
1:153.2.0esr-1
thunderbird
Mageia:10
From an advisory covering 31 CVEs
 before 153.2.0-1.mga10
153.2.0-1.mga10
thunderbird-l10n
Mageia:10
From an advisory covering 31 CVEs
 before 153.2.0-1.mga10
153.2.0-1.mga10
thunderbird
Mageia:9
From an advisory covering 31 CVEs
 before 140.15.0-1.mga9
140.15.0-1.mga9
thunderbird-l10n
Mageia:9
From an advisory covering 31 CVEs
 before 140.15.0-1.mga9
140.15.0-1.mga9
Show 51 moreShow less
Affected packages
PackageAffectedFixed
thunderbird
openEuler:24.03-LTS-SP4
From an advisory covering 11 CVEs
 before 140.15.0-1.oe2403sp4
140.15.0-1.oe2403sp4
thunderbird
openEuler:24.03-LTS-SP3
From an advisory covering 11 CVEs
 before 140.15.0-1.oe2403sp3
140.15.0-1.oe2403sp3
thunderbird
Red Hat:enterprise_linux:9::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird
Red Hat:enterprise_linux:10.2
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
thunderbird
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_4
0:140.15.0-1.el9_4
thunderbird-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_4
0:140.15.0-1.el9_4
thunderbird-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_4
0:140.15.0-1.el9_4
thunderbird
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el10_0
0:140.15.0-1.el10_0
thunderbird-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el10_0
0:140.15.0-1.el10_0
thunderbird-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el10_0
0:140.15.0-1.el10_0
thunderbird
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_2
0:140.15.0-1.el9_2
thunderbird-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_2
0:140.15.0-1.el9_2
thunderbird-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_2
0:140.15.0-1.el9_2
thunderbird
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_6
0:140.15.0-1.el9_6
thunderbird-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_6
0:140.15.0-1.el9_6
thunderbird-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 0:140.15.0-1.el9_6
0:140.15.0-1.el9_6
thunderbird
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird
Rocky Linux:9
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird
Rocky Linux:10
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird
Rocky Linux:8
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 143 CVEs
 before 153.2.0-150400.13.3.1
153.2.0-150400.13.3.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 143 CVEs
 before 153.2.0-150400.13.3.1
153.2.0-150400.13.3.1
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
thunderbird
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:115.3.1+build1-0ubuntu11:115.4.1+build1-0ubuntu11:115.4.3+build1-0ubuntu11:115.5.0+build1-0ubuntu11:115.5.1+build1-0ubuntu1
Show 9 moreShow less
1:115.5.2+build2-0ubuntu11:115.6.0+build1-0ubuntu11:115.6.0+build2-0ubuntu11:115.6.1+build1-0ubuntu11:115.8.0+build1-0ubuntu11:115.8.1+build1+snap21:115.8.1+build1+snap32:1snap1-0ubuntu12:1snap1-0ubuntu3
 None known
thunderbird
Ubuntu:26.10
 All versions, plus listed versions
2:1snap1-0ubuntu5
 None known
thunderbird
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:1snap1-0ubuntu32:1snap1-0ubuntu42:1snap1-0ubuntu5
 None known
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 140.15.0-1.1
140.15.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-84641 is a high vulnerability (CVSS 7.5) in Mozilla Thunderbird, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in thunderbird 1:140.15.0esr-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 256 versions, 219 references and the rest of 7 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open