Mozilla Thunderbird Email client
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Mozilla Thunderbird.
Recent Mozilla Thunderbird Security Advisories
| Advisory | Title | Published |
|---|---|---|
| mfsa2026-114 | Security Vulnerabilities fixed in Thunderbird 158.0.1 mfsa2026-114 | October 20, 2026 |
| mfsa2026-115 | Security Vulnerabilities fixed in Thunderbird 153.5.1 mfsa2026-115 | October 20, 2026 |
| mfsa2026-109 | Security Vulnerabilities fixed in Thunderbird 158 mfsa2026-109 | October 13, 2026 |
| mfsa2026-110 | Security Vulnerabilities fixed in Thunderbird 153.5 mfsa2026-110 | October 13, 2026 |
| mfsa2026-101 | Security Vulnerabilities fixed in Thunderbird 157 mfsa2026-101 | September 30, 2026 |
| mfsa2026-102 | Security Vulnerabilities fixed in Thunderbird 140.17 mfsa2026-102 | September 30, 2026 |
| mfsa2026-103 | Security Vulnerabilities fixed in Thunderbird 153.4 mfsa2026-103 | September 30, 2026 |
| mfsa2026-96 | Security Vulnerabilities fixed in Thunderbird 153.3 mfsa2026-96 | September 16, 2026 |
| mfsa2026-94 | Security Vulnerabilities fixed in Thunderbird 156 mfsa2026-94 | September 15, 2026 |
| mfsa2026-95 | Security Vulnerabilities fixed in Thunderbird 140.16 mfsa2026-95 | September 15, 2026 |
By the Year
In 2026 there have been 474 vulnerabilities in Mozilla Thunderbird with an average score of 8.0 out of ten. Last year, in 2025 Thunderbird had 157 security vulnerabilities published. That is, 317 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.32.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 474 | 7.97 |
| 2025 | 157 | 7.65 |
| 2024 | 119 | 7.15 |
| 2023 | 102 | 7.49 |
| 2022 | 116 | 7.56 |
| 2021 | 73 | 7.23 |
| 2020 | 80 | 7.59 |
| 2019 | 62 | 8.21 |
| 2018 | 167 | 8.24 |
It may take a day or so for new Thunderbird vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Mozilla Thunderbird Security Vulnerabilities
Firefox Networking Component Info Disclosure (pre-140.17/153.4/157)
CVE-2026-96869
4.3 - Medium
- September 29, 2026
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Information Disclosure
Thunderbird <140.16 OOB Read in IMAP Parser via * ID Response
CVE-2026-92240
9.1 - Critical
- September 15, 2026
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Out-of-bounds Read
OOB buffer read in Thunderbird IMAP parser before 140.16
CVE-2026-92239
8.1 - High
- September 15, 2026
A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Out-of-bounds Read
Memory Safety Violation via Malformed Mail Header in Thunderbird <140.16
CVE-2026-92238
9.8 - Critical
- September 15, 2026
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
HTTP Request Smuggling
Widget: Win32 Mitigation Bypass in Firefox 156 ESR 153.3
CVE-2026-92079
9.1 - Critical
- September 15, 2026
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Firefox Denial-of-service in Security component before 156
CVE-2026-92078
6.5 - Medium
- September 15, 2026
Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Allocation of Resources Without Limits or Throttling
DoS in Firefox SVG component before v156
CVE-2026-92077
6.5 - Medium
- September 15, 2026
Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Allocation of Resources Without Limits or Throttling
Firefox 156+ Boundary Condition Flaw in Networking Component
CVE-2026-92076
8.8 - High
- September 15, 2026
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Mitigation bypass in Firefox Networking component pre-156/ESR153.3
CVE-2026-92075
9.1 - Critical
- September 15, 2026
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Mitigation Bypass in Firefox Popup Blocker (before 156)
CVE-2026-92074
8.8 - High
- September 15, 2026
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Firefox: PrivEsc via Enterprise Policies pre-156/153.3
CVE-2026-92073
8.8 - High
- September 15, 2026
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Improper Privilege Management
Firefox SB boundary issue fixed in v156/ESR153.3
CVE-2026-92072
8 - High
- September 15, 2026
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Firefox Sandbox Escape via Widget Boundaries fixed in v156/ESR 153.3
CVE-2026-92071
9.6 - Critical
- September 15, 2026
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Firefox Info Disclosure in Networking Comp (before 156/ESR 153.3)
CVE-2026-92070
4.3 - Medium
- September 15, 2026
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Information Disclosure
Firefox Navigation Component Spoofing (fixed in 156)
CVE-2026-92069
5.4 - Medium
- September 15, 2026
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
User Interface (UI) Misrepresentation of Critical Information
Site isolation flaw in Firefox Reader Mode (pre156/ESR153.3)
CVE-2026-92068
5.4 - Medium
- September 15, 2026
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Origin Validation Error
Use-after-free in Gtk Widget for Firefox/Thunderbird <156
CVE-2026-92067
8.8 - High
- September 15, 2026
Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Dangling pointer
Sandbox escape in Firefox/Thunderbird Profile Backup
CVE-2026-92066
9.8 - Critical
- September 15, 2026
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Protection Mechanism Failure
Firefox sandbox escape in Win32 Widget before v156
CVE-2026-92065
8.8 - High
- September 15, 2026
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
CVE-2026-92064: Win32 Widget Sandbox Esc. in Firefox<156, Thunderbird<156
CVE-2026-92064
8.8 - High
- September 15, 2026
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
DoS in Audio/Video component of Firefox & Thunderbird
CVE-2026-92063
6.5 - Medium
- September 15, 2026
Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Allocation of Resources Without Limits or Throttling
Privilege escalation via Session Restore in Firefox/Thunderbird before 156/153.3
CVE-2026-92062
8.8 - High
- September 15, 2026
Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Improper Privilege Management
Incorrect boundary conditions in Process Sandboxing (Firefox/Thunderbird)
CVE-2026-92061
9.8 - Critical
- September 15, 2026
Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Buffer Overflow
Use-After-Free in Firefox/Thunderbird i18n before v156
CVE-2026-92060
8.8 - High
- September 15, 2026
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Dangling pointer
Mozilla Firefox 156 DOM Boundary Condition Vulnerability in Editor
CVE-2026-92059
9.3 - Critical
- September 15, 2026
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Firefox Graphics UA-FREE before v156
CVE-2026-92058
8.8 - High
- September 15, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Dangling pointer
Mitigation Bypass in Firefox Enterprise Policies (v156)
CVE-2026-92057
9.1 - Critical
- September 15, 2026
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Use-after-free in Firefox Text component (pre-156)
CVE-2026-92056
8.8 - High
- September 15, 2026
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Dangling pointer
Privilege Escalation in DevTools (Firefox/Thunderbird) < v156
CVE-2026-92055
8.8 - High
- September 15, 2026
Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Improper Privilege Management
Privilege Escalation in Firefox Memory Component (before 156)
CVE-2026-92054
8.8 - High
- September 15, 2026
Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Privilege Escalation in CanvasWebGL (Firefox <156/Thunderbird <156)
CVE-2026-92053
8.8 - High
- September 15, 2026
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Improper Privilege Management
Firefox CanvasWebGL PrivEsc via Uninit Mem (Pre-156)
CVE-2026-92052
8.8 - High
- September 15, 2026
Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Use of Uninitialized Variable
Graphics Pointer Spoofing in Mozilla Firefox & Thunderbird
CVE-2026-92051
9.1 - Critical
- September 15, 2026
Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
NULL Pointer Dereference
XPConnect Race Condition Sandbox Escape in Firefox/Thunderbird
CVE-2026-92050
9.1 - Critical
- September 15, 2026
Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Race Condition
UAF in Firefox Widget (Win32) before 156
CVE-2026-92049
8.8 - High
- September 15, 2026
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Dangling pointer
Firefox/Thunderbird Sandbox Escape via Widget Win32 Boundary (pre-156/153.3)
CVE-2026-92048
9 - Critical
- September 15, 2026
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Privilege Escalation in CR component before Firefox 156
CVE-2026-92047
8.8 - High
- September 15, 2026
Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Improper Privilege Management
Use-after-free in Firefox Graphics before v156
CVE-2026-92046
8.8 - High
- September 15, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Dangling pointer
Firefox 156 Sandbox Escape in WebRTC Component
CVE-2026-92045
9.6 - Critical
- September 15, 2026
Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Buffer Overflow
Mozilla Firefox 156 Info Disclosure in Networking:HTTP Component
CVE-2026-92044
7.5 - High
- September 15, 2026
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Information Disclosure
Privilege Escalation: Audio/Video Boundary Bug in Firefox<156 & Thunderbird<156
CVE-2026-92043
8.8 - High
- September 15, 2026
Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Classic Buffer Overflow
DOM Content Processes Race Cond. pre-156 Firefox/ESR 153.3
CVE-2026-92042
7.5 - High
- September 15, 2026
Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Race Condition
Mitigation Bypass in Firefox/Thunderbird DOM Networking (156/ESR153.3)
CVE-2026-92041
9.1 - Critical
- September 15, 2026
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Use-After-Free in JS WebAssembly (Firefox & Thunderbird)
CVE-2026-92040
8.8 - High
- September 15, 2026
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Dangling pointer
Mitigation Bypass in Mozilla Firefox 156 Notifications DOM Component
CVE-2026-92039
6.3 - Medium
- September 15, 2026
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Mitigation Bypass in Remote Settings Client (FF 156, ESR 153.3, Thunderbird 156)
CVE-2026-92038
9.1 - Critical
- September 15, 2026
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Protection Mechanism Failure
Mozilla Firefox/Thunderbird DOM Animation Boundary Condition Flaw
CVE-2026-92037
9.8 - Critical
- September 15, 2026
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Buffer Overflow
Firefox/Thunderbird 156 Boundary Error in Net:HTTP Component
CVE-2026-92036
9.8 - Critical
- September 15, 2026
Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Buffer Overflow
Sandbox escape: Graphics boundary bug in Thunderbird/Firefox <140.17/156
CVE-2026-92035
9.6 - Critical
- September 15, 2026
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.
Buffer Overflow
Site Isolation Flaw in Firefox & Thunderbird Graphics Component
CVE-2026-92034
9.1 - Critical
- September 15, 2026
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Origin Validation Error
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Mozilla Thunderbird or by Mozilla? Click the Watch button to subscribe.
