Thunderbird vulnerabilities

801 known vulnerabilities in Thunderbird from Mozilla. 800 are rated high or critical, and 14 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

801vulnerabilities

229critical

571high

14exploited

8.7average CVSS score

Latest first

9.6 Critical severity
Firefox: Use After Free
CVE-2026-117971Oct 27, 2026Mozilla
Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Concurrent Execution using Shared Resource with Improper Synchronization
CVE-2026-117970Oct 27, 2026Mozilla
Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Access of Uninitialized Pointer
CVE-2026-117969Oct 27, 2026Mozilla
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117968Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Protection Mechanism Failure
CVE-2026-117967Oct 27, 2026Mozilla
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Origin Validation Error
CVE-2026-117966Oct 27, 2026Mozilla
Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Origin Validation Error
CVE-2026-117965Oct 27, 2026Mozilla
Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117964Oct 27, 2026Mozilla
Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117963Oct 27, 2026Mozilla
Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117962Oct 27, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117961Oct 27, 2026Mozilla
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Improper Access Control
CVE-2026-117959Oct 27, 2026Mozilla
Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Origin Validation Error
CVE-2026-117958Oct 27, 2026Mozilla
Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Missing Cryptographic Step
CVE-2026-117957Oct 27, 2026Mozilla
Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Access of Uninitialized Pointer
CVE-2026-117956Oct 27, 2026Mozilla
Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Access of Resource Using Incompatible Type
CVE-2026-117955Oct 27, 2026Mozilla
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117954Oct 27, 2026Mozilla
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117953Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Use of Uninitialized Variable
CVE-2026-117952Oct 27, 2026Mozilla
Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117951Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117950Oct 27, 2026Mozilla
Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117949Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117946Oct 27, 2026Mozilla
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117945Oct 27, 2026Mozilla
Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Double Free
CVE-2026-117943Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
7.3 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117942Oct 27, 2026Mozilla
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117941Oct 27, 2026Mozilla
Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117940Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
7.3 High severity
Firefox: Access of Uninitialized Pointer
CVE-2026-117937Oct 27, 2026Mozilla
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117936Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117932Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117931Oct 27, 2026Mozilla
Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117930Oct 27, 2026Mozilla
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117929Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Origin Validation Error
CVE-2026-117928Oct 27, 2026Mozilla
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.1 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-117926Oct 27, 2026Mozilla
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117925Oct 27, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117922Oct 27, 2026Mozilla
Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
8.8 High severity
Firefox: Use After Free
CVE-2026-117921Oct 27, 2026Mozilla
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-117920Oct 27, 2026Mozilla
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.