{"id":"CVE-2026-110249","aliases":["CLSA-2026-1792779937","DEBIAN-CVE-2026-110249","EUVD-2026-99208","GHSA-3vgg-r2jh-qqpj","MGASA-2026-0523","SUSE-SU-2026:4736-1","UBUNTU-CVE-2026-110249","openSUSE-SU-2026:12224-1"],"status":"published","title":"Denial-of-service in the Exchange email component","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0018,"percentile":0.07582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-10-13T18:08:38Z","modified":"2026-10-28T17:50:34Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:153.5.1esr-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:153.5.1esr-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:153.5.0esr-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-1.el9_2.alma.1.tuxcare.els1"}]}],"bundled":125},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.5.1esr-1~deb12u1"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1","1:102.13.1-1~deb12u1","1:102.14.0-1~deb10u1","1:102.14.0-1~deb11u1","1:102.14.0-1~deb12u1","1:102.15.0-1~deb10u1","1:102.15.0-1~deb11u1","1:102.15.0-1~deb12u1","1:102.15.1-1~deb10u1","1:102.15.1-1~deb11u1","1:102.15.1-1~deb12u1","1:103.0~b5-1","1:104.0~b2-1","1:110.0~b4-1","1:112.0~b1-1","1:113.0~b3-1","1:114.0~b2-1","1:115.0-1","1:115.0.1-1","1:115.0.1-2","1:115.0~b4-1","1:115.0~b6-1","1:115.1.0-1","1:115.1.1-1","1:115.10.1-1","1:115.10.1-1~deb10u1","1:115.10.1-1~deb11u1","1:115.10.1-1~deb12u1","1:115.11.0-1","1:115.11.0-1~deb10u1","1:115.11.0-1~deb11u1","1:115.11.0-1~deb12u1","1:115.12.0-1","1:115.12.0-1~deb10u1","1:115.12.0-1~deb11u1","1:115.12.0-1~deb12u1","1:115.13.0-1","1:115.13.0-1~deb11u1","1:115.13.0-1~deb12u1","1:115.14.0-1~deb11u1","1:115.14.0-1~deb12u1","1:115.15.0-1~deb11u1","1:115.15.0-1~deb12u1","1:115.16.0esr-1~deb11u1","1:115.16.0esr-1~deb12u1","1:115.2.0-1","1:115.2.2-1","1:115.3.0-1","1:115.3.0-1~deb12u1","1:115.3.1-1","1:115.3.1-1~deb10u1","1:115.3.1-1~deb11u1","1:115.3.1-1~deb12u1","1:115.4.1-1","1:115.4.1-1~deb10u1","1:115.4.1-1~deb11u1","1:115.4.1-1~deb12u1","1:115.5.0-1","1:115.5.0-1~deb10u1","1:115.5.0-1~deb11u1","1:115.5.0-1~deb12u1","1:115.5.1-1","1:115.5.2-1","1:115.6.0-1","1:115.6.0-1~deb10u1","1:115.6.0-1~deb11u1","1:115.6.0-1~deb12u1","1:115.7.0-1","1:115.7.0-1~deb10u1","1:115.7.0-1~deb11u1","1:115.7.0-1~deb12u1","1:115.8.0-1","1:115.8.0-1~deb10u1","1:115.8.0-1~deb11u1","1:115.8.0-1~deb12u1","1:115.8.1-1","1:115.9.0-1","1:115.9.0-1~deb10u1","1:115.9.0-1~deb11u1","1:115.9.0-1~deb12u1","1:116.0~b7-1","1:117.0~b5-1","1:120.0~b1-1","1:121.0~b3-1","1:122.0~b2-1","1:124.0~b5-1","1:125.0~b3-1","1:127.0~b5-1","1:128.0esr-1","1:128.0~b5-1","1:128.1.0esr-1","1:128.1.1esr-1","1:128.10.0esr-1","1:128.10.0esr-1~deb11u1","1:128.10.0esr-1~deb12u1","1:128.10.1esr-1","1:128.10.1esr-1~deb11u1","1:128.10.1esr-1~deb12u1","1:128.11.0esr-1","1:128.11.0esr-1~deb11u1","1:128.11.0esr-1~deb12u1","1:128.12.0esr-1","1:128.12.0esr-1~deb11u1","1:128.12.0esr-1~deb12u1","1:128.13.0esr-1","1:128.13.0esr-1~deb11u1","1:128.13.0esr-1~deb12u1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:128.2.0esr-1","1:128.2.1esr-1","1:128.2.3esr-1","1:128.3.0esr-1","1:128.3.2esr-1","1:128.4.0esr-1","1:128.4.0esr-1~deb11u1","1:128.4.0esr-1~deb12u1","1:128.4.2esr-1","1:128.4.3esr-1","1:128.4.3esr-1~deb11u1","1:128.4.3esr-1~deb12u1","1:128.5.0esr-1","1:128.5.0esr-1~deb11u1","1:128.5.0esr-1~deb12u1","1:128.5.2esr-1","1:128.6.0esr-1","1:128.6.0esr-1~deb11u1","1:128.6.0esr-1~deb12u1","1:128.7.0esr-1","1:128.7.0esr-1~deb11u1","1:128.7.0esr-1~deb12u1","1:128.8.0esr-1","1:128.8.0esr-1~deb11u1","1:128.8.0esr-1~deb12u1","1:128.9.0esr-1","1:128.9.0esr-1~deb11u1","1:128.9.0esr-1~deb12u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.5.1esr-1~deb13u1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.5.0esr-1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-1.mga10"}]}],"bundled":62},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-1.mga10"}]}],"bundled":62},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"bundled":86},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.1-1.1"}]}],"bundled":66}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2077826","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-110/","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110249"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-110"},{"url":"https://github.com/advisories/GHSA-3vgg-r2jh-qqpj"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792779937.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100757","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100758","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100787","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103500","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96869","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110249","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0523.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36509","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.5.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-110/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259712","tags":["report"]},{"url":"https://bugzilla.suse.com/1259727","tags":["report"]},{"url":"https://bugzilla.suse.com/1259730","tags":["report"]},{"url":"https://bugzilla.suse.com/1262263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264713","tags":["report"]},{"url":"https://bugzilla.suse.com/1275108","tags":["report"]},{"url":"https://bugzilla.suse.com/1275605","tags":["report"]},{"url":"https://bugzilla.suse.com/1275736","tags":["report"]},{"url":"https://bugzilla.suse.com/1282347","tags":["report"]},{"url":"https://bugzilla.suse.com/1284493","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93990","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110249","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110249","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-110249","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113868","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110249","title":"Denial-of-service in the Exchange email component","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","status":"published","published":"2026-10-13T18:08:38.179Z","modified":"2026-10-21T17:25:10.583Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-99208","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","status":"published","published":"2026-10-13T18:08:38Z","modified":"2026-10-21T17:25:10Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:36.259658Z"}],"ghsa":[{"id":"GHSA-3vgg-r2jh-qqpj","title":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP...","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","status":"published","published":"2026-10-13T21:33:46Z","modified":"2026-10-20T18:31:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:14:04.153849Z"}],"nvd":[{"id":"CVE-2026-110249","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","status":"published","published":"2026-10-13T19:18:49.59Z","modified":"2026-10-20T18:17:17.907Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:57.132005Z"}],"osv":[{"id":"DEBIAN-CVE-2026-110249","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","status":"published","published":"2026-10-13T19:18:49.59Z","modified":"2026-10-26T20:00:12.472679147Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110249","description":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","status":"published","published":"2026-10-13T19:18:00Z","modified":"2026-10-28T17:50:34Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"CLSA-2026-1792779937","title":"thunderbird: Fix of 56 CVEs","description":"- update to 153.5.0 ESR (MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5)\n- drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch,\n  their fixes are part of 153.5.0\n- stop packaging rnp-cli and rnpkeys: upstream no longer installs\n  them (bug 2068130); librnp.so is still shipped\n- regenerate langpacks from the 153.5.0esr release xpi set (66 languages,\n  the same set as 153.3.1esr)\n- CVE-2026-103500: Heap buffer overflow opening large email\n- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component\n- CVE-2026-100757: Use-after-free in the Widget component\n- CVE-2026-100758: Sandbox escape in the DOM: Navigation component\n- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component\n- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component\n- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component\n- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component\n- CVE-2026-100766: Information disclosure in the Networking: JAR component\n- CVE-2026-100767: Use-after-free in the Networking: Cache component\n- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component\n- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component\n- CVE-2026-100771: Undefined behavior in the DOM: Streams component\n- CVE-2026-100772: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component\n- CVE-2026-100774: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100775: Sandbox escape in the Graphics component\n- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component\n- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100779: Use-after-free in the XSLT component\n- CVE-2026-100780: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component\n- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component\n- CVE-2026-100783: Uninitialized memory in the Audio/Video component\n- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component\n- CVE-2026-100785: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component\n- CVE-2026-100787: Sandbox escape in the XUL component\n- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component\n- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-100790: Use-after-free in the XSLT component\n- CVE-2026-100791: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component\n- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component\n- CVE-2026-96869: Information disclosure in the Networking component\n- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component\n- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component\n- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component\n- CVE-2026-100801: Privilege escalation in the DLL Services component\n- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component\n- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component\n- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component\n- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component\n- CVE-2026-100809: Same-origin policy bypass in the DevTools component\n- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-100812: Denial-of-service in the Graphics component\n- CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component\n- CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component\n- CVE-2026-100816: Site isolation issue in the DOM: Networking component\n- CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component\n- CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component\n- CVE-2026-100820: Privilege escalation in the Address Bar component\n- CVE-2026-100821: Site isolation issue in the Panning and Zooming component\n- CVE-2026-100822: Spoofing issue in the Networking: HTTP component\n- CVE-2026-100824: Privilege escalation in the Places component\n- CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component\n- CVE-2026-100826: Denial-of-service in the Storage: StorageManager component\n- CVE-2026-100828: Mitigation bypass in the Bookmarks \u0026 History component\n- CVE-2026-100829: Mitigation bypass in the DOM: Security component\n- CVE-2026-100830: Mitigation bypass in the DOM: Navigation component\n- CVE-2026-100831: Use-after-free in the DOM: UI Events \u0026 Focus Handling component\n- CVE-2026-110249: Denial-of-service in the Exchange email component\n- CVE-2026-109704: Privilege escalation in the Application Update component\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component\n- CVE-2026-109710: Use-after-free in the Graphics: Text component\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component\n- CVE-2026-109713: Use-after-free in the Crash Reporting component\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component\n- CVE-2026-109718: Use-after-free in the XML component\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component\n- CVE-2026-109726: Use-after-free in the SVG component\n- CVE-2026-109727: Use-after-free in the Audio/Video component\n- CVE-2026-109728: Use-after-free in the DOM: Animation component\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component\n- CVE-2026-109730: Integer overflow in the Graphics component\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component\n- CVE-2026-109732: Use-after-free in the DOM: Streams component\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component\n- CVE-2026-109736: Frame poisoning in the Layout component\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component\n- CVE-2026-109742: Information disclosure in the PDF Viewer component\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component\n- CVE-2026-109744: Other issue in the DOM: File component\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component\n- CVE-2026-109782: Mitigation bypass in the File Handling component\n- CVE-2026-109751: Information disclosure in the Networking component\n- CVE-2026-109752: Use-after-free in the DOM: Workers component\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component\n- CVE-2026-109759: Site isolation issue in the Networking component\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component\n- CVE-2026-109763: Mitigation bypass in the File Handling component\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-109767: Information disclosure in the Networking component\n- CVE-2026-109783: Mitigation bypass in the File Handling component\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component\n- CVE-2026-109775: Denial-of-service in the WebRTC component\n- CVE-2026-109776: Race condition in the XPCOM component\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component\n- CVE-2026-109778: Privilege escalation in the WebExtensions component\n- CVE-2026-109781: Denial-of-service in the Printing: Output component","status":"published","published":"2026-10-23T18:27:45Z","modified":"2026-10-26T09:43:19.875538635Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0523","title":"Updated thunderbird packages fix security vulnerabilities","description":"Denial-of-service in the Exchange email component. (CVE-2026-110249)\nPrivilege escalation in the Application Update component.\n(CVE-2026-109704)\nSandbox escape, site isolation issue due to incorrect boundary\nconditions, use-after-free in the Networking component.\n(CVE-2026-109705)\nUse-after-free in the Storage: IndexedDB component. (CVE-2026-109706)\nSandbox escape due to use-after-free in the Networking component.\n(CVE-2026-109707)\nSandbox escape due to incorrect boundary conditions in the Networking\ncomponent. (CVE-2026-109708)\nInformation disclosure, privilege escalation in the Security: Process\nSandboxing component. (CVE-2026-109709)\nUse-after-free in the Graphics: Text component. (CVE-2026-109710)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-109711)\nSandbox escape due to uninitialized memory in the Graphics component.\n(CVE-2026-109712)\nUse-after-free in the Crash Reporting component. (CVE-2026-109713)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-109715)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-109716)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-109717)\nUse-after-free in the XML component. (CVE-2026-109718)\nRace condition, use-after-free in the Graphics: CanvasWebGL component.\n(CVE-2026-109719)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-109720)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-109721)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-109722)\nInteger overflow in the Layout: Text and Fonts component.\n(CVE-2026-109723)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-109724)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-109725)\nUse-after-free in the SVG component. (CVE-2026-109726)\nUse-after-free in the Audio/Video component. (CVE-2026-109727)\nUse-after-free in the DOM: Animation component. (CVE-2026-109728)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-109729)\nInteger overflow in the Graphics component. (CVE-2026-109730)\nIncorrect boundary conditions in the Graphics: Canvas2D component.\n(CVE-2026-109731)\nUse-after-free in the DOM: Streams component. (CVE-2026-109732)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-109733)\nMitigation bypass in the DOM: Security component. (CVE-2026-109734)\nFrame poisoning in the Layout component. (CVE-2026-109736)\nMitigation bypass in the Enterprise Policies component.\n(CVE-2026-109737)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-109738)\nUse-after-free in the Storage: Bucket File System component.\n(CVE-2026-109741)\nInformation disclosure in the PDF Viewer component. (CVE-2026-109742)\nPrivilege escalation in the Panning and Zooming component.\n(CVE-2026-109743)\nOther issue in the DOM: File component. (CVE-2026-109744)\nSandbox escape due to uninitialized memory in the DOM: Web Serial\ncomponent. (CVE-2026-109745)\nMitigation bypass in the File Handling component. (CVE-2026-109782)\nInformation disclosure in the Networking component. (CVE-2026-109751)\nUse-after-free in the DOM: Workers component. (CVE-2026-109752)\nIncorrect boundary conditions in the Layout component. (CVE-2026-109753)\nIncorrect boundary conditions in the DOM: Editor component.\n(CVE-2026-109754)\nPrivilege escalation in the DOM: Navigation component. (CVE-2026-109756)\nSandbox escape due to race condition in the Networking component.\n(CVE-2026-109757)\nSite isolation issue in the Networking component. (CVE-2026-109759)\nMitigation bypass in the Networking: HTTP component. (CVE-2026-109760)\nIncorrect boundary conditions in the SVG component. (CVE-2026-109762)\nMitigation bypass in the File Handling component. (CVE-2026-109763)\nMitigation bypass in the Enterprise Policies component.\n(CVE-2026-109764)\nRace condition, use-after-free in the Graphics: Text component.\n(CVE-2026-109765)\nMitigation bypass in the Enterprise Policies component.\n(CVE-2026-109766)\nInformation disclosure in the Networking component. (CVE-2026-109767)\nMitigation bypass in the File Handling component. (CVE-2026-109783)\nSpoofing issue in the DOM: Web Serial component. (CVE-2026-109770)\nDenial-of-service in the WebRTC component. (CVE-2026-109775)\nRace condition in the XPCOM component. (CVE-2026-109776)\nInformation disclosure in the Storage: IndexedDB component.\n(CVE-2026-109777)\nPrivilege escalation in the WebExtensions component. (CVE-2026-109778)\nDenial-of-service in the Printing: Output component. (CVE-2026-109781)\n","status":"published","published":"2026-10-20T02:38:36Z","modified":"2026-10-20T02:58:15.997333063Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12224-1","title":"MozillaThunderbird-153.5.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-153.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-22T00:00:00Z","modified":"2026-10-23T17:23:11.557727532Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4736-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n- CVE-2026-110249: Denial-of-service in the Exchange email component.\n\nlibexpat updated:\n \n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service (bsc#1275108).\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks (bsc#1275108).\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275736).\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service (bsc#1275605).\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash (bsc#1275736).\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks (bsc#1275736).\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption (bsc#1275736).\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters (bsc#1282347).\n","status":"published","published":"2026-10-19T12:57:04Z","modified":"2026-10-20T10:45:04.190986882Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}