{"id":"CVE-2026-103500","aliases":["CLSA-2026-1792779937","DEBIAN-CVE-2026-103500","EUVD-2026-90200","GHSA-vjxp-5j85-5rqg","MGASA-2026-0492","OESA-2026-4457","OESA-2026-4458","SUSE-SU-2026:4627-1","UBUNTU-CVE-2026-103500","openSUSE-SU-2026:12098-1"],"status":"published","title":"Heap buffer overflow opening large email","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00277,"percentile":0.20393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2026-09-30T17:15:06Z","modified":"2026-10-26T09:43:19Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:140.17.0esr-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:140.17.0esr-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:153.4.0esr-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"thunderbird","fixed_in":["140.17.0-1.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"thunderbird","fixed_in":["140.17.0-1.oe2403sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-1.el9_2.alma.1.tuxcare.els1"}]}],"bundled":125},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:140.17.0esr-1~deb12u1"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1","1:102.13.1-1~deb12u1","1:102.14.0-1~deb10u1","1:102.14.0-1~deb11u1","1:102.14.0-1~deb12u1","1:102.15.0-1~deb10u1","1:102.15.0-1~deb11u1","1:102.15.0-1~deb12u1","1:102.15.1-1~deb10u1","1:102.15.1-1~deb11u1","1:102.15.1-1~deb12u1","1:103.0~b5-1","1:104.0~b2-1","1:110.0~b4-1","1:112.0~b1-1","1:113.0~b3-1","1:114.0~b2-1","1:115.0-1","1:115.0.1-1","1:115.0.1-2","1:115.0~b4-1","1:115.0~b6-1","1:115.1.0-1","1:115.1.1-1","1:115.10.1-1","1:115.10.1-1~deb10u1","1:115.10.1-1~deb11u1","1:115.10.1-1~deb12u1","1:115.11.0-1","1:115.11.0-1~deb10u1","1:115.11.0-1~deb11u1","1:115.11.0-1~deb12u1","1:115.12.0-1","1:115.12.0-1~deb10u1","1:115.12.0-1~deb11u1","1:115.12.0-1~deb12u1","1:115.13.0-1","1:115.13.0-1~deb11u1","1:115.13.0-1~deb12u1","1:115.14.0-1~deb11u1","1:115.14.0-1~deb12u1","1:115.15.0-1~deb11u1","1:115.15.0-1~deb12u1","1:115.16.0esr-1~deb11u1","1:115.16.0esr-1~deb12u1","1:115.2.0-1","1:115.2.2-1","1:115.3.0-1","1:115.3.0-1~deb12u1","1:115.3.1-1","1:115.3.1-1~deb10u1","1:115.3.1-1~deb11u1","1:115.3.1-1~deb12u1","1:115.4.1-1","1:115.4.1-1~deb10u1","1:115.4.1-1~deb11u1","1:115.4.1-1~deb12u1","1:115.5.0-1","1:115.5.0-1~deb10u1","1:115.5.0-1~deb11u1","1:115.5.0-1~deb12u1","1:115.5.1-1","1:115.5.2-1","1:115.6.0-1","1:115.6.0-1~deb10u1","1:115.6.0-1~deb11u1","1:115.6.0-1~deb12u1","1:115.7.0-1","1:115.7.0-1~deb10u1","1:115.7.0-1~deb11u1","1:115.7.0-1~deb12u1","1:115.8.0-1","1:115.8.0-1~deb10u1","1:115.8.0-1~deb11u1","1:115.8.0-1~deb12u1","1:115.8.1-1","1:115.9.0-1","1:115.9.0-1~deb10u1","1:115.9.0-1~deb11u1","1:115.9.0-1~deb12u1","1:116.0~b7-1","1:117.0~b5-1","1:120.0~b1-1","1:121.0~b3-1","1:122.0~b2-1","1:124.0~b5-1","1:125.0~b3-1","1:127.0~b5-1","1:128.0esr-1","1:128.0~b5-1","1:128.1.0esr-1","1:128.1.1esr-1","1:128.10.0esr-1","1:128.10.0esr-1~deb11u1","1:128.10.0esr-1~deb12u1","1:128.10.1esr-1","1:128.10.1esr-1~deb11u1","1:128.10.1esr-1~deb12u1","1:128.11.0esr-1","1:128.11.0esr-1~deb11u1","1:128.11.0esr-1~deb12u1","1:128.12.0esr-1","1:128.12.0esr-1~deb11u1","1:128.12.0esr-1~deb12u1","1:128.13.0esr-1","1:128.13.0esr-1~deb11u1","1:128.13.0esr-1~deb12u1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:128.2.0esr-1","1:128.2.1esr-1","1:128.2.3esr-1","1:128.3.0esr-1","1:128.3.2esr-1","1:128.4.0esr-1","1:128.4.0esr-1~deb11u1","1:128.4.0esr-1~deb12u1","1:128.4.2esr-1","1:128.4.3esr-1","1:128.4.3esr-1~deb11u1","1:128.4.3esr-1~deb12u1","1:128.5.0esr-1","1:128.5.0esr-1~deb11u1","1:128.5.0esr-1~deb12u1","1:128.5.2esr-1","1:128.6.0esr-1","1:128.6.0esr-1~deb11u1","1:128.6.0esr-1~deb12u1","1:128.7.0esr-1","1:128.7.0esr-1~deb11u1","1:128.7.0esr-1~deb12u1","1:128.8.0esr-1","1:128.8.0esr-1~deb11u1","1:128.8.0esr-1~deb12u1","1:128.9.0esr-1","1:128.9.0esr-1~deb11u1","1:128.9.0esr-1~deb12u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:140.17.0esr-1~deb13u1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.4.0esr-1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-1.mga10"}]}],"bundled":63},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-3.mga10"}]}],"bundled":63},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.17.0-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.17.0-1.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-150400.13.6.1"}]}],"bundled":129},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-150400.13.6.1"}]}],"bundled":129},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-1.1"}]}],"bundled":138}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2070267","tags":["Permissions Required","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-101/","tags":["Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102/","tags":["Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-103/","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103500","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-101"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-103"},{"url":"https://github.com/advisories/GHSA-vjxp-5j85-5rqg"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792779937.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100757","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100758","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100787","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96869","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-103500","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0492.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36416","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.4.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4457","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4458","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264627-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280371","tags":["report"]},{"url":"https://bugzilla.suse.com/1282929","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96869","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-103500","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103500","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-103500","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84642","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-103500","title":"Heap buffer overflow opening large email","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","status":"published","published":"2026-09-30T17:15:06.357Z","modified":"2026-10-21T17:24:51.272Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-90200","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","status":"published","published":"2026-09-30T17:15:06Z","modified":"2026-10-21T17:24:51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:59:36.259658Z"}],"ghsa":[{"id":"GHSA-vjxp-5j85-5rqg","title":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater...","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","status":"published","published":"2026-09-30T18:33:51Z","modified":"2026-10-16T21:32:16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T15:13:52.91817Z"}],"nvd":[{"id":"CVE-2026-103500","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","status":"published","published":"2026-09-30T18:18:18.12Z","modified":"2026-10-16T19:17:01.55Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-787","CWE-122"],"updated_at":"2026-11-02T14:12:53.097633Z"}],"osv":[{"id":"DEBIAN-CVE-2026-103500","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","status":"published","published":"2026-09-30T18:18:18.12Z","modified":"2026-10-23T17:47:50.349915209Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"OESA-2026-4457","title":"thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nAn attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.(CVE-2026-103500)","status":"published","published":"2026-10-22T14:35:22Z","modified":"2026-10-22T14:45:05.433648771Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4458","title":"thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nAn attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.(CVE-2026-103500)","status":"published","published":"2026-10-22T14:35:22Z","modified":"2026-10-22T14:45:06.682964489Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"UBUNTU-CVE-2026-103500","description":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.","status":"published","published":"2026-09-30T18:18:00Z","modified":"2026-10-22T10:30:04.155092421Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"CLSA-2026-1792779937","title":"thunderbird: Fix of 56 CVEs","description":"- update to 153.5.0 ESR (MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5)\n- drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch,\n  their fixes are part of 153.5.0\n- stop packaging rnp-cli and rnpkeys: upstream no longer installs\n  them (bug 2068130); librnp.so is still shipped\n- regenerate langpacks from the 153.5.0esr release xpi set (66 languages,\n  the same set as 153.3.1esr)\n- CVE-2026-103500: Heap buffer overflow opening large email\n- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component\n- CVE-2026-100757: Use-after-free in the Widget component\n- CVE-2026-100758: Sandbox escape in the DOM: Navigation component\n- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component\n- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component\n- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component\n- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component\n- CVE-2026-100766: Information disclosure in the Networking: JAR component\n- CVE-2026-100767: Use-after-free in the Networking: Cache component\n- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component\n- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component\n- CVE-2026-100771: Undefined behavior in the DOM: Streams component\n- CVE-2026-100772: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component\n- CVE-2026-100774: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100775: Sandbox escape in the Graphics component\n- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component\n- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100779: Use-after-free in the XSLT component\n- CVE-2026-100780: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component\n- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component\n- CVE-2026-100783: Uninitialized memory in the Audio/Video component\n- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component\n- CVE-2026-100785: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component\n- CVE-2026-100787: Sandbox escape in the XUL component\n- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component\n- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-100790: Use-after-free in the XSLT component\n- CVE-2026-100791: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component\n- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component\n- CVE-2026-96869: Information disclosure in the Networking component\n- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component\n- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component\n- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component\n- CVE-2026-100801: Privilege escalation in the DLL Services component\n- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component\n- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component\n- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component\n- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component\n- CVE-2026-100809: Same-origin policy bypass in the DevTools component\n- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100812: Denial-of-service in the Graphics component\n- CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component\n- CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component\n- CVE-2026-100816: Site isolation issue in the DOM: Networking component\n- CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component\n- CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component\n- CVE-2026-100820: Privilege escalation in the Address Bar component\n- CVE-2026-100821: Site isolation issue in the Panning and Zooming component\n- CVE-2026-100822: Spoofing issue in the Networking: HTTP component\n- CVE-2026-100824: Privilege escalation in the Places component\n- CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component\n- CVE-2026-100826: Denial-of-service in the Storage: StorageManager component\n- CVE-2026-100828: Mitigation bypass in the Bookmarks \u0026 History component\n- CVE-2026-100829: Mitigation bypass in the DOM: Security component\n- CVE-2026-100830: Mitigation bypass in the DOM: Navigation component\n- CVE-2026-100831: Use-after-free in the DOM: UI Events \u0026 Focus Handling component\n- CVE-2026-110249: Denial-of-service in the Exchange email component\n- CVE-2026-109704: Privilege escalation in the Application Update component\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component\n- CVE-2026-109710: Use-after-free in the Graphics: Text component\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component\n- CVE-2026-109713: Use-after-free in the Crash Reporting component\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component\n- CVE-2026-109718: Use-after-free in the XML component\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-109726: Use-after-free in the SVG component\n- CVE-2026-109727: Use-after-free in the Audio/Video component\n- CVE-2026-109728: Use-after-free in the DOM: Animation component\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component\n- CVE-2026-109730: Integer overflow in the Graphics component\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component\n- CVE-2026-109732: Use-after-free in the DOM: Streams component\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component\n- CVE-2026-109736: Frame poisoning in the Layout component\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component\n- CVE-2026-109742: Information disclosure in the PDF Viewer component\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component\n- CVE-2026-109744: Other issue in the DOM: File component\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component\n- CVE-2026-109782: Mitigation bypass in the File Handling component\n- CVE-2026-109751: Information disclosure in the Networking component\n- CVE-2026-109752: Use-after-free in the DOM: Workers component\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component\n- CVE-2026-109759: Site isolation issue in the Networking component\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component\n- CVE-2026-109763: Mitigation bypass in the File Handling component\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-109767: Information disclosure in the Networking component\n- CVE-2026-109783: Mitigation bypass in the File Handling component\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component\n- CVE-2026-109775: Denial-of-service in the WebRTC component\n- CVE-2026-109776: Race condition in the XPCOM component\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component\n- CVE-2026-109778: Privilege escalation in the WebExtensions component\n- CVE-2026-109781: Denial-of-service in the Printing: Output component","status":"published","published":"2026-10-23T18:27:45Z","modified":"2026-10-26T09:43:19.875538635Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0492","title":"Updated thunderbird packages fix security vulnerabilities","description":"Heap buffer overflow opening large email. (CVE-2026-103500)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-100756)\nUse-after-free in the Widget component. (CVE-2026-100757)\nSandbox escape in the DOM: Navigation component. (CVE-2026-100758)\nUninitialized memory in the Storage: Quota Manager component.\n(CVE-2026-100759)\nSandbox escape in the Security: Process Sandboxing component.\n(CVE-2026-100760)\nSandbox escape due to use-after-free in the DOM: Content Processes\ncomponent. (CVE-2026-100762)\nUse-after-free in the JavaScript: WebAssembly component.\n(CVE-2026-100765)\nInformation disclosure in the Networking: JAR component.\n(CVE-2026-100766)\nUse-after-free in the Networking: Cache component. (CVE-2026-100767)\nUse-after-free in the JavaScript: WebAssembly component.\n(CVE-2026-100769)\nSandbox escape due to use-after-free in the DOM: Content Processes\ncomponent. (CVE-2026-100770)\nUndefined behavior in the DOM: Streams component. (CVE-2026-100771)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-100772)\nUse-after-free in the Storage: IndexedDB component. (CVE-2026-100773)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-100774)\nSandbox escape in the Graphics component. (CVE-2026-100775)\nUse-after-free in the JavaScript: WebAssembly component.\n(CVE-2026-100776)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-100777)\nSandbox escape due to use-after-free in the DOM: Core \u0026 HTML component.\n(CVE-2026-100778)\nUse-after-free in the XSLT component. (CVE-2026-100779)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-100780)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-100781)\nPrivilege escalation due to incorrect boundary conditions in the\nGraphics component. (CVE-2026-100782)\nUninitialized memory in the Audio/Video component. (CVE-2026-100783)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-100784)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-100785)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-100786)\nSandbox escape in the XUL component. (CVE-2026-100787)\nInvalid pointer in the JavaScript: WebAssembly component.\n(CVE-2026-100788)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-100789)\nUse-after-free in the XSLT component. (CVE-2026-100790)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-100791)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-100832)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-100792)\nSandbox escape due to incorrect boundary conditions in the\nInternationalization component. (CVE-2026-100794)\nInformation disclosure in the Networking component. (CVE-2026-96869)\nPrivilege escalation due to use-after-free in the Graphics: WebRender\ncomponent. (CVE-2026-100797)\nCryptography misuse in Storage: Quota Manager component.\n(CVE-2026-100798)\nSandbox escape due to use-after-free in the Disability Access APIs\ncomponent. (CVE-2026-100800)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nSame-origin policy bypass in the WebExtensions component.\n(CVE-2026-100803)\nUninitialized memory in the Graphics: WebGPU component.\n(CVE-2026-100806)\nPrivilege escalation in the DOM: Service Workers component.\n(CVE-2026-100807)\nMitigation bypass in the DOM: Service Workers component.\n(CVE-2026-100808)\nSame-origin policy bypass in the DevTools component. (CVE-2026-100809)\nSandbox escape due to use-after-free in the DOM: Core \u0026 HTML component.\n(CVE-2026-100811)\nDenial-of-service in the Graphics component. (CVE-2026-100812)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-100814)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-100815)\nSite isolation issue in the DOM: Networking component. (CVE-2026-100816)\nSandbox escape due to use-after-free in the Widget: Gtk component.\n(CVE-2026-100818)\nSandbox escape due to incorrect boundary conditions in the XPCOM\ncomponent. (CVE-2026-100819)\nPrivilege escalation in the Address Bar component. (CVE-2026-100820)\nSite isolation issue in the Panning and Zooming component.\n(CVE-2026-100821)\nSpoofing issue in the Networking: HTTP component. (CVE-2026-100822)\nPrivilege escalation in the Places component. (CVE-2026-100824)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-100825)\nDenial-of-service in the Storage: StorageManager component.\n(CVE-2026-100826)\nMitigation bypass in the Bookmarks \u0026 History component.\n(CVE-2026-100828)\nMitigation bypass in the DOM: Security component. (CVE-2026-100829)\nMitigation bypass in the DOM: Navigation component. (CVE-2026-100830)\nUse-after-free in the DOM: UI Events \u0026 Focus Handling component.\n(CVE-2026-100831)\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:13:24.382450372Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12098-1","title":"MozillaThunderbird-153.4.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-153.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.85762477Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4627-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371, bsc#1282929):\n\n- CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.\n- CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92015: Privilege escalation in the WebExtensions component.\n- CVE-2026-92016: Use-after-free in the Disability Access APIs component.\n- CVE-2026-92017: Privilege escalation in the DOM: Service Workers component.\n- CVE-2026-92018: Sandbox escape in the DOM: Core \u0026 HTML component.\n- CVE-2026-92019: Mitigation bypass in the Remote Settings Client component.\n- CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-92022: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-92023: Use-after-free in the XML component.\n- CVE-2026-92024: Use-after-free in the SVG component.\n- CVE-2026-92025: Use-after-free in the DOM: Navigation component.\n- CVE-2026-92026: Use-after-free in the Networking component.\n- CVE-2026-92027: Use-after-free in the DOM: Streams component.\n- CVE-2026-92028: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-92029: Use-after-free in the SVG component.\n- CVE-2026-92030: Mitigation bypass in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component.\n- CVE-2026-92031: Information disclosure in the Graphics: ImageLib component.\n- CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component.\n- CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component.\n- CVE-2026-92038: Mitigation bypass in the Remote Settings Client component.\n- CVE-2026-92039: Mitigation bypass in the DOM: Notifications component.\n- CVE-2026-92041: Mitigation bypass in the DOM: Networking component.\n- CVE-2026-92042: Race condition in the DOM: Content Processes component.\n- CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component.\n- CVE-2026-92044: Information disclosure in the Networking: HTTP component.\n- CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component.\n- CVE-2026-92046: Use-after-free in the Graphics component.\n- CVE-2026-92047: Privilege escalation in the Crash Reporting component.\n- CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92049: Use-after-free in the Widget: Win32 component.\n- CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component.\n- CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component.\n- CVE-2026-92054: Privilege escalation in the Memory component.\n- CVE-2026-92055: Privilege escalation in the DevTools component.\n- CVE-2026-92056: Use-after-free in the Graphics: Text component.\n- CVE-2026-92057: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-92058: Use-after-free in the Graphics component.\n- CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-92060: Use-after-free in the Internationalization component.\n- CVE-2026-92062: Privilege escalation in the Session Restore component.\n- CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92067: Use-after-free in the Widget: Gtk component.\n- CVE-2026-92068: Site isolation issue in the Reader Mode component.\n- CVE-2026-92069: Spoofing issue in the DOM: Navigation component.\n- CVE-2026-92070: Information disclosure in the Networking component.\n- CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing component.\n- CVE-2026-92073: Privilege escalation in the Enterprise Policies component.\n- CVE-2026-92074: Mitigation bypass in the Popup Blocker component.\n- CVE-2026-92075: Mitigation bypass in the Networking component.\n- CVE-2026-92076: Incorrect boundary conditions in the Networking component.\n- CVE-2026-92077: Denial-of-service in the SVG component.\n- CVE-2026-92078: Denial-of-service in the Security component.\n- CVE-2026-92079: Mitigation bypass in the Widget: Win32 component.\n- CVE-2026-92238: Ambiguous parsing of mail headers.\n- CVE-2026-92239: Buffer overrun in IMAP.\n- CVE-2026-92240: Out-of-bounds read in IMAP response parser.\n- CVE-2026-96869: Information disclosure in the Networking component.\n- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component.\n- CVE-2026-100757: Use-after-free in the Widget component.\n- CVE-2026-100758: Sandbox escape in the DOM: Navigation component.\n- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component.\n- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component.\n- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component.\n- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.\n- CVE-2026-100766: Information disclosure in the Networking: JAR component.\n- CVE-2026-100767: Use-after-free in the Networking: Cache component.\n- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.\n- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component.\n- CVE-2026-100771: Undefined behavior in the DOM: Streams component.\n- CVE-2026-100772: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-100774: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100775: Sandbox escape in the Graphics component.\n- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.\n- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100779: Use-after-free in the XSLT component.\n- CVE-2026-100780: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component.\n- CVE-2026-100783: Uninitialized memory in the Audio/Video component.\n- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-100785: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component.\n- CVE-2026-100787: Sandbox escape in the XUL component.\n- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.\n- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-100790: Use-after-free in the XSLT component.\n- CVE-2026-100791: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component.\n- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component.\n- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.\n- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component.\n- CVE-2026-100801: Privilege escalation in the DLL Services component.\n- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.\n- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.\n- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.\n- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.\n- CVE-2026-100809: Same-origin policy bypass in the DevTools component.\n- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-100812: Denial-of-service in the Graphics component.\n- CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-100816: Site isolation issue in the DOM: Networking component.\n- CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component.\n- CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component.\n- CVE-2026-100820: Privilege escalation in the Address Bar component.\n- CVE-2026-100821: Site isolation issue in the Panning and Zooming component.\n- CVE-2026-100822: Spoofing issue in the Networking: HTTP component.\n- CVE-2026-100824: Privilege escalation in the Places component.\n- CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.\n- CVE-2026-100828: Mitigation bypass in the Bookmarks \u0026 History component.\n- CVE-2026-100829: Mitigation bypass in the DOM: Security component.\n- CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.\n- CVE-2026-100831: Use-after-free in the DOM: UI Events \u0026 Focus Handling component.\n- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-103500: Heap buffer overflow opening large email.\n\nChanges for MozillaThunderbird:\n\n * changed: RNP command-line utilities are no longer included\n with Thunderbird (bmo#2068130)\n * changed: Thundermail built-in add-on updated to v2.0.16\n (bmo#2071989)\n * fixed: Ctrl+Shift+K could fail to open the Quick Filter UI\n (bmo#2062942)\n * fixed: Nested S/MIME signed parts could fail to render\n (bmo#2062971)\n * fixed: Thunderbird could hang when waiting for IMAP server\n greeting during account setup (bmo#2028760)\n * fixed: Gmail OAuth2 authentication could intermittently fail\n on Windows (bmo#2063816)\n * fixed: `AppUpdatePin` policy did not prevent Thunderbird from\n updating beyond pinned version (bmo#1910603)\n * fixed: 'What's New?' linked to Release channel notes instead\n of ESR release notes (bmo#2073813)\n * fixed: Detached attachment links were truncated when folder\n path contained `\u0026` (bmo#2060451)\n * fixed: Save All, Detach All, and Delete All failed after\n deleting one attachment (bmo#2057025)\n * fixed: Blank 1970-dated messages could appear from incomplete\n message file copies (bmo#209501)\n * fixed: Forwarded messages could display incorrect encoding\n (bmo#2059963)\n * fixed: Manual Get Messages failed after startup until\n toggling offline mode (bmo#2057431)\n * fixed: Thunderbird could crash on shutdown while waiting for\n OAuth2 password entry (bmo#1524247)\n","status":"published","published":"2026-10-12T14:57:41Z","modified":"2026-10-13T10:30:05.948962102Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}