Every CVE Search/ Get API key

CVE-2026-92240

Out-of-bounds read in IMAP response parser

9.1 CriticalFix available

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.63%Up 0.4 points since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Out-of-bounds read in IMAP response parser

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Record
CVE-2026-92240
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-79244 9.1

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Record
EUVD-2026-79244
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-wq87-gp3m-ww5v 9.1

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response...

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.

Record
GHSA-wq87-gp3m-ww5v
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 9.1

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Record
CVE-2026-92240
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-92240 9.1

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Record
DEBIAN-CVE-2026-92240
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-4409 9.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100756)

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100757)

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100758)

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100759)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100762)

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100766)

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100767)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100769)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100770)

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100771)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100772)

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100773)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100774)

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100775)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100776)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100777)

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird…

Record
OESA-2026-4409
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 22 moreShow less
OSVOESA-2026-4410 9.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100756)

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100757)

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100758)

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100759)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100762)

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100766)

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100767)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100769)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100770)

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100771)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100772)

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100773)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100774)

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100775)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100776)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100777)

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird…

Record
OESA-2026-4410
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:70642 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:70642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73130 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:73130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73971 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:73971
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81392 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81392
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81393 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81393
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81394 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81394
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81884 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81884
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81912 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81912
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:81913 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:81913
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:82122 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2026:82122
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:70642 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to…

Record
RLSA-2026:70642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:73130 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to…

Record
RLSA-2026:73130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:73971 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to…

Record
RLSA-2026:73971
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-92240 9.1

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Record
UBUNTU-CVE-2026-92240
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:70642 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
  • firefox:…
Record
ALSA-2026:70642
Updated
2026-11-02
OSVALSA-2026:73130 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
  • firefox:…
Record
ALSA-2026:73130
Updated
2026-11-02
OSVALSA-2026:73971 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
  • firefox:…
Record
ALSA-2026:73971
Updated
2026-11-02
OSVCLSA-2026-1791305177 No score

thunderbird: Fix of 65 CVEs

  • update to 153.3.1 ESR (MFSA 2026-96)
  • 153.3.1 is a respin of 153.3 and carries no security content of its own; every fix listed below comes from 153.3
  • regenerate langpacks from the 153.3.1esr release xpi set (66 languages, the same set as 153.2.0esr)
  • CVE-2026-92238: Ambiguous parsing of mail headers
  • CVE-2026-92239: Buffer overrun in IMAP
  • CVE-2026-92240: Out-of-bounds read in IMAP response parser
  • CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component
  • CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-92015: Privilege escalation in the WebExtensions component
  • CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component
  • CVE-2026-92016: Use-after-free in the Disability Access APIs component
  • CVE-2026-92017: Privilege escalation in the DOM: Service Workers component
  • CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component
  • CVE-2026-92019: Mitigation bypass in the Remote Settings Client component
  • CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
  • CVE-2026-92022: Use-after-free in the DOM: HTML Parser component
  • CVE-2026-92023: Use-after-free in the XML component
  • CVE-2026-92024: Use-after-free in the SVG component
  • CVE-2026-92025: Use-after-free in the DOM: Navigation component
  • CVE-2026-92026: Use-after-free in the Networking component
  • CVE-2026-92027: Use-after-free in the DOM: Streams component
  • CVE-2026-92028: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-92029: Use-after-free in the SVG component
  • CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
  • CVE-2026-92031: Information disclosure in the Graphics: ImageLib component
  • CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component
  • CVE-2026-92038: Mitigation bypass in the Remote Settings Client component
  • CVE-2026-92039: Mitigation bypass in the DOM: Notifications component
  • CVE-2026-92041: Mitigation bypass in the DOM: Networking component
  • CVE-2026-92042: Race condition in the DOM: Content Processes component
  • CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component
  • CVE-2026-92044: Information disclosure in the Networking: HTTP component
  • CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component
  • CVE-2026-92046: Use-after-free in the Graphics component
  • CVE-2026-92047: Privilege escalation in the Crash Reporting component
  • CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
  • CVE-2026-92049: Use-after-free in the Widget: Win32 component
  • CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component
  • CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component
  • CVE-2026-92054: Privilege escalation in the Memory component
  • CVE-2026-92055: Privilege escalation in the DevTools component
  • CVE-2026-92056: Use-after-free in the Graphics: Text component
  • CVE-2026-92057: Mitigation bypass in the…
Record
CLSA-2026-1791305177
Updated
2026-11-02
OSVMGASA-2026-0449 No score

Updated thunderbird & thunderbird-l10n packages fix security vulnerabilities

Ambiguous parsing of mail headers. (CVE-2026-92238) Buffer overrun in IMAP. (CVE-2026-92239) Out-of-bounds read in IMAP response parser. (CVE-2026-92240) Use-after-free in the Audio/Video: Web Codecs component. (CVE-2026-92005) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92006) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92007) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92008) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92009) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92010) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92011) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92012) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92013) Privilege escalation due to incorrect boundary conditions in the Graphics component. (CVE-2026-92014) Privilege escalation in the WebExtensions component. (CVE-2026-92015) Use-after-free in the Disability Access APIs component. (CVE-2026-92016) Privilege escalation in the DOM: Service Workers component. (CVE-2026-92017) Sandbox escape in the DOM: Core & HTML component. (CVE-2026-92018) Mitigation bypass in the Remote Settings Client component. (CVE-2026-92019) Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. (CVE-2026-92020) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-92021) Use-after-free in the DOM: HTML Parser component. (CVE-2026-92022) Use-after-free in the XML component. (CVE-2026-92023) Use-after-free in the SVG component. (CVE-2026-92024) Use-after-free in the DOM: Navigation component. (CVE-2026-92025) Use-after-free in the Networking component. (CVE-2026-92026) Use-after-free in the DOM: Streams component. (CVE-2026-92027) Use-after-free in the DOM: Core & HTML component. (CVE-2026-92028) Use-after-free in the SVG component. (CVE-2026-92029) Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. (CVE-2026-92030) Information disclosure in the Graphics: ImageLib component. (CVE-2026-92031) Sandbox escape due to invalid pointer in the Graphics component. (CVE-2026-92032) Mitigation bypass in the Remote Settings Client component. (CVE-2026-92038) Mitigation bypass in the DOM: Notifications component. (CVE-2026-92039) Mitigation bypass in the DOM: Networking component. (CVE-2026-92041) Race condition in the DOM: Content Processes component. (CVE-2026-92042) Privilege escalation due to incorrect boundary conditions in the Audio/Video component. (CVE-2026-92043) Information disclosure in the Networking: HTTP component. (CVE-2026-92044) Sandbox escape due to incorrect boundary conditions in the WebRTC component. (CVE-2026-92045) Use-after-free in the Graphics component. (CVE-2026-92046) Privilege escalation in the Crash Reporting component. (CVE-2026-92047) Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. (CVE-2026-92052) Privilege escalation in the Graphics: CanvasWebGL component. (CVE-2026-92053) Privilege escalation in the Memory component. (CVE-2026-92054) Privilege escalation in the DevTools component. (CVE-2026-92055) Use-after-free in the Graphics: Text component. (CVE-2026-92056) Mitigation bypass in the Enterprise Policies component. (CVE-2026-92057) Use-after-free in the Graphics component. (CVE-2026-92058) Incorrect boundary conditions in the DOM: Editor component. (CVE-2026-92059) Use-after-free in the Internationalization component. (CVE-2026-92060) Privilege escalation in the Session Restore component. (CVE-2026-92062) Use-after-free in the Widget: Gtk component.…

Record
MGASA-2026-0449
Updated
2026-11-02
OSVopenSUSE-SU-2026:11827-1 No score

MozillaThunderbird-140.16.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11827-1
Updated
2026-11-02
OSVSUSE-SU-2026:4627-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371, bsc#1282929):

  • CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.
  • CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92015: Privilege escalation in the WebExtensions component.
  • CVE-2026-92016: Use-after-free in the Disability Access APIs component.
  • CVE-2026-92017: Privilege escalation in the DOM: Service Workers component.
  • CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component.
  • CVE-2026-92019: Mitigation bypass in the Remote Settings Client component.
  • CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-92022: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-92023: Use-after-free in the XML component.
  • CVE-2026-92024: Use-after-free in the SVG component.
  • CVE-2026-92025: Use-after-free in the DOM: Navigation component.
  • CVE-2026-92026: Use-after-free in the Networking component.
  • CVE-2026-92027: Use-after-free in the DOM: Streams component.
  • CVE-2026-92028: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-92029: Use-after-free in the SVG component.
  • CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.
  • CVE-2026-92031: Information disclosure in the Graphics: ImageLib component.
  • CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component.
  • CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component.
  • CVE-2026-92038: Mitigation bypass in the Remote Settings Client component.
  • CVE-2026-92039: Mitigation bypass in the DOM: Notifications component.
  • CVE-2026-92041: Mitigation bypass in the DOM: Networking component.
  • CVE-2026-92042: Race condition in the DOM: Content Processes component.
  • CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component.
  • CVE-2026-92044: Information disclosure in the Networking: HTTP component.
  • CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component.
  • CVE-2026-92046: Use-after-free in the Graphics component.
  • CVE-2026-92047: Privilege escalation in the Crash Reporting component.
  • CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
  • CVE-2026-92049: Use-after-free in the Widget: Win32 component.
  • CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component.
  • CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component.
  • CVE-2026-92054: Privilege escalation in the Memory component.
  • CVE-2026-92055: Privilege escalation in the DevTools component.
  • CVE-2026-92056: Use-after-free in the Graphics: Text component.
  • CVE-2026-92057: Mitigation bypass in the Enterprise Policies component.
  • CVE-2026-92058: Use-after-free in the Graphics component.
  • CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component.
  • CVE-2026-92060: Use-after-free in the…
Record
SUSE-SU-2026:4627-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
thunderbird
AlmaLinux:9
From an advisory covering 44 CVEs
 before 140.16.0-1.el9_8.alma.1
140.16.0-1.el9_8.alma.1
thunderbird
AlmaLinux:10
From an advisory covering 44 CVEs
 before 140.16.0-1.el10_2.alma.1
140.16.0-1.el10_2.alma.1
thunderbird
AlmaLinux:8
From an advisory covering 44 CVEs
 before 140.16.0-1.el8_10.alma.1
140.16.0-1.el8_10.alma.1
thunderbird
TuxCare:AlmaLinux:9.2
From an advisory covering 66 CVEs
 before 153.3.1-1.el9_2.alma.1.tuxcare.els1
153.3.1-1.el9_2.alma.1.tuxcare.els1
thunderbird
Debian:12
 before 1:140.16.0esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.16.0esr-1~deb12u1
thunderbird
Debian:13
 before 1:140.16.0esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u1
1:140.16.0esr-1~deb13u1
thunderbird
Debian:14
 before 1:153.3.0esr-1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1
1:153.3.0esr-1
thunderbird
Mageia:10
From an advisory covering 62 CVEs
 before 153.3.0-1.mga10
153.3.0-1.mga10
thunderbird-l10n
Mageia:10
From an advisory covering 62 CVEs
 before 153.3.0-1.mga10
153.3.0-1.mga10
thunderbird
Mageia:9
From an advisory covering 62 CVEs
 before 140.16.0-1.mga9
140.16.0-1.mga9
Show 58 moreShow less
Affected packages
PackageAffectedFixed
thunderbird-l10n
Mageia:9
From an advisory covering 62 CVEs
 before 140.16.0-1.mga9
140.16.0-1.mga9
thunderbird
openEuler:24.03-LTS-SP3
From an advisory covering 74 CVEs
 before 140.16.0-1.oe2403sp3
140.16.0-1.oe2403sp3
thunderbird
openEuler:24.03-LTS-SP4
From an advisory covering 74 CVEs
 before 140.16.0-1.oe2403sp4
140.16.0-1.oe2403sp4
thunderbird
Red Hat:enterprise_linux:9::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird
Red Hat:enterprise_linux:10.2
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
thunderbird
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el10_0
0:140.16.0-1.el10_0
thunderbird-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el10_0
0:140.16.0-1.el10_0
thunderbird-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el10_0
0:140.16.0-1.el10_0
thunderbird
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_4
0:140.16.0-1.el9_4
thunderbird-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_4
0:140.16.0-1.el9_4
thunderbird-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_4
0:140.16.0-1.el9_4
thunderbird
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_2
0:140.16.0-1.el9_2
thunderbird-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_2
0:140.16.0-1.el9_2
thunderbird-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_2
0:140.16.0-1.el9_2
thunderbird
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_6
0:140.16.0-1.el9_6
thunderbird-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_6
0:140.16.0-1.el9_6
thunderbird-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 31 CVEs
 before 0:140.16.0-1.el9_6
0:140.16.0-1.el9_6
thunderbird
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_8
0:140.16.0-1.el8_8
thunderbird
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_6
0:140.16.0-1.el8_6
thunderbird
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_4
0:140.16.0-1.el8_4
thunderbird
Rocky Linux:9
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el9_8
0:140.16.0-1.el9_8
thunderbird
Rocky Linux:10
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el10_2
0:140.16.0-1.el10_2
thunderbird
Rocky Linux:8
From an advisory covering 44 CVEs
 before 0:140.16.0-1.el8_10
0:140.16.0-1.el8_10
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 129 CVEs
 before 153.4.0-150400.13.6.1
153.4.0-150400.13.6.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 129 CVEs
 before 153.4.0-150400.13.6.1
153.4.0-150400.13.6.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs102
Ubuntu:22.04:LTS
 All versions, plus listed versions
102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
mozjs91
Ubuntu:22.04:LTS
 All versions, plus listed versions
91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1
 None known
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
mozjs102
Ubuntu:24.04:LTS
 All versions, plus listed versions
102.15.1-1102.15.1-3ubuntu2
 None known
mozjs115
Ubuntu:24.04:LTS
 All versions, plus listed versions
115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4
Show 4 moreShow less
115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1
 None known
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 31 CVEs
 before 140.16.0-1.1
140.16.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92240 is a critical vulnerability (CVSS 9.1) in Mozilla Thunderbird, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in thunderbird 1:140.16.0esr-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 261 versions, 286 references and the rest of 11 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open