Mozilla Thunderbird Email client
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Mozilla Thunderbird.
Recent Mozilla Thunderbird Security Advisories
| Advisory | Title | Published |
|---|---|---|
| mfsa2026-122 | Security Vulnerabilities fixed in Thunderbird 153.6 mfsa2026-122 | October 27, 2026 |
| mfsa2026-121 | Security Vulnerabilities fixed in Thunderbird 159 mfsa2026-121 | October 27, 2026 |
| mfsa2026-114 | Security Vulnerabilities fixed in Thunderbird 158.0.1 mfsa2026-114 | October 20, 2026 |
| mfsa2026-115 | Security Vulnerabilities fixed in Thunderbird 153.5.1 mfsa2026-115 | October 20, 2026 |
| mfsa2026-109 | Security Vulnerabilities fixed in Thunderbird 158 mfsa2026-109 | October 13, 2026 |
| mfsa2026-110 | Security Vulnerabilities fixed in Thunderbird 153.5 mfsa2026-110 | October 13, 2026 |
| mfsa2026-101 | Security Vulnerabilities fixed in Thunderbird 157 mfsa2026-101 | September 30, 2026 |
| mfsa2026-102 | Security Vulnerabilities fixed in Thunderbird 140.17 mfsa2026-102 | September 30, 2026 |
| mfsa2026-103 | Security Vulnerabilities fixed in Thunderbird 153.4 mfsa2026-103 | September 30, 2026 |
| mfsa2026-96 | Security Vulnerabilities fixed in Thunderbird 153.3 mfsa2026-96 | September 16, 2026 |
By the Year
In 2026 there have been 808 vulnerabilities in Mozilla Thunderbird with an average score of 7.9 out of ten. Last year, in 2025 Thunderbird had 157 security vulnerabilities published. That is, 651 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.24.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 808 | 7.89 |
| 2025 | 157 | 7.65 |
| 2024 | 119 | 7.14 |
| 2023 | 102 | 7.49 |
| 2022 | 116 | 7.56 |
| 2021 | 73 | 7.23 |
| 2020 | 80 | 7.59 |
| 2019 | 62 | 8.21 |
| 2018 | 167 | 8.24 |
It may take a day or so for new Thunderbird vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Mozilla Thunderbird Security Vulnerabilities
Thunderbird <159/153.6 Matrix homeserver URL leads to NTLM leak (Win)
CVE-2026-118180
7.5 - High
- October 27, 2026
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Open Redirect
Thunderbird <=159/153.6 snews: SSRF & command injection (CVE-2026-118179)
CVE-2026-118179
8.8 - High
- October 27, 2026
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Improper Input Validation
Thunderbird <159, 153.6> Remote RSS Feed file URL Local File Read (NTLM Leak)
CVE-2026-118178
5.7 - Medium
- October 27, 2026
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Inclusion of Functionality from Untrusted Control Sphere
Thunderbird <159 pre) Calendar URL SSRF leads to NTLM credential leak
CVE-2026-118177
9.1 - Critical
- October 27, 2026
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Open Redirect
Thunderbird <159/153.6 Email Composition Content Disclosure
CVE-2026-118175
7.5 - High
- October 27, 2026
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Information Disclosure
Thunderbird <159 Windows extended UNC bypass (NTLM leak)
CVE-2026-118176
8.1 - High
- October 27, 2026
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Information Disclosure
Thunderbird < 159 (Windows) OpenPGP attachment remote load NTLM leak
CVE-2026-118174
6.5 - Medium
- October 27, 2026
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Inclusion of Functionality from Untrusted Control Sphere
Mozilla Firefox/Thunderbird JS GC Invalid Pointer
CVE-2026-118026
8.8 - High
- October 27, 2026
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
SVG component flaw in Firefox/Thunderbird (CVE-2026-118025)
CVE-2026-118025
8.8 - High
- October 27, 2026
Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Improper Input Validation
Mozilla Firefox/Thunderbird Use-After-Free in Graphics Text Component
CVE-2026-118024
8.8 - High
- October 27, 2026
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7.
Dangling pointer
Firefox/Thunderbird WebRender UAF Sandbox Escape (CVE-2026-118023)
CVE-2026-118023
8.8 - High
- October 27, 2026
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird Use-After-Free Sandbox Escape via Disability Access APIs
CVE-2026-118022
8.8 - High
- October 27, 2026
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird XPCOM UAF Sandbox Escape
CVE-2026-118021
8.8 - High
- October 27, 2026
Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7.
Dangling pointer
Use-After-Free in Firefox/Thunderbird Layout Component
CVE-2026-118020
8.8 - High
- October 27, 2026
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird DOM File UAF Race Condition
CVE-2026-118019
8.8 - High
- October 27, 2026
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7.
Race Condition
Mozilla Firefox/Thunderbird SVG Use-After-Free
CVE-2026-118017
8.8 - High
- October 27, 2026
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Use-After-Free in Firefox DOM Core/HTML Component (CVE-2026-118016)
CVE-2026-118016
8.8 - High
- October 27, 2026
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird Use-After-Free in DOM Core/HTML (CVE2026118015)
CVE-2026-118015
8.8 - High
- October 27, 2026
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird JIT Use-After-Free (CVE-2026-118014)
CVE-2026-118014
8.8 - High
- October 27, 2026
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird Use-After-Free in Layout Images/Video/HTML Frames
CVE-2026-118013
8.8 - High
- October 27, 2026
Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird DOM Animation UAF
CVE-2026-118012
8.8 - High
- October 27, 2026
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird Text Graphics UAF & Integer Overflow
CVE-2026-118009
8.8 - High
- October 27, 2026
Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Integer Overflow or Wraparound
Mozilla Firefox/Thunderbird Use-After-Free in Disability Access APIs
CVE-2026-118010
8.8 - High
- October 27, 2026
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird CSS Parsing Frame Poisoning (CVE-2026-118011)
CVE-2026-118011
8.8 - High
- October 27, 2026
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
User Interface (UI) Misrepresentation of Critical Information
Mozilla Firefox/Thunderbird WebRTC Signaling UAF PrivEsc
CVE-2026-118006
8.8 - High
- October 27, 2026
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird Use-After-Free in JS GC
CVE-2026-118007
8.8 - High
- October 27, 2026
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7.
Dangling pointer
Use-After-Free in Mozilla WebRTC Signaling (Firefox/Thunderbird)
CVE-2026-118005
8.8 - High
- October 27, 2026
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird CSS Transitions Boundary Error pre159
CVE-2026-118004
8.1 - High
- October 27, 2026
Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird DNS info disclosure (<=158)
CVE-2026-118003
8.1 - High
- October 27, 2026
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Mozilla Firefox/Thunderbird IPC Race Condition (fixed in 159, ESR 153.6)
CVE-2026-117999
8.8 - High
- October 27, 2026
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Race Condition
Firefox & Thunderbird HTTP Networking info disclosure before 159
CVE-2026-118000
8.1 - High
- October 27, 2026
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Mozilla Firefox/Thunderbird Networking Race Cond Info Disclosure (<=159)
CVE-2026-118002
8.1 - High
- October 27, 2026
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Firefox/Thunderbird Widget UAF sandbox escape (pre159)
CVE-2026-117997
9.6 - Critical
- October 27, 2026
Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Mozilla Firefox/Thunderbird DOM Push Subscriptions Bypass (fixed in 159/153.6)
CVE-2026-117998
8.8 - High
- October 27, 2026
Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Protection Mechanism Failure
Firefox UI Events & Focus Handling PrivEsc (pre159)
CVE-2026-117995
8.8 - High
- October 27, 2026
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Authorization
Firefox/Thunderbird WebRTC Boundary Check Bypass (pre159)
CVE-2026-117996
8.1 - High
- October 27, 2026
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Use-After-Free in JS GC (fixed in 159, ESR 153.6)
CVE-2026-117994
8.8 - High
- October 27, 2026
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Text & Fonts Layout OOB Boundary (pre 159)
CVE-2026-117991
8.8 - High
- October 27, 2026
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Text Component Integer Overflow (pre159)
CVE-2026-117993
8.8 - High
- October 27, 2026
Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Integer Overflow or Wraparound
Mozilla Firefox/Thunderbird CSS Parser Info Disclosure (pre-159/115.44)
CVE-2026-117992
6.5 - Medium
- October 27, 2026
Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Mozilla Firefox/Thunderbird WebRender Sandbox Escape (pre159/153.6)
CVE-2026-117990
9.6 - Critical
- October 27, 2026
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Graphics UAF (fixed in 159, ESR 153.6)
CVE-2026-117989
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Mozilla Firefox/Thunderbird CanvasWebGL Sandbox Escape (pre159/153.6)
CVE-2026-117988
9.6 - Critical
- October 27, 2026
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Mozilla Firefox/Thunderbird Graphics UAF before 159/153.6
CVE-2026-117987
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Graphics UAF (fixed in 159/153.6)
CVE-2026-117986
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Use-After-Free in Graphics (pre-159)
CVE-2026-117983
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Layout Scrolling & Overflow OOB before 159
CVE-2026-117984
8.8 - High
- October 27, 2026
Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Mozilla Firefox/Thunderbird Graphics UAF Sandbox Escape (pre159)
CVE-2026-117985
9.6 - Critical
- October 27, 2026
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird JIT Invalid Pointer Vulnerability (fixed in 159/153.6)
CVE-2026-117982
9.8 - Critical
- October 27, 2026
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Toolkit Privilege Escalation (pre-159/153.6)
CVE-2026-117981
9.8 - Critical
- October 27, 2026
Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Improper Privilege Management
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Mozilla Thunderbird or by Mozilla? Click the Watch button to subscribe.
