Thunderbird vulnerabilities

801 known vulnerabilities in Thunderbird from Mozilla. 800 are rated high or critical, and 14 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

801vulnerabilities

229critical

571high

14exploited

8.7average CVSS score

Latest first

8.1 High severity
Firefox: Missing Cryptographic Step
CVE-2026-100798Sep 29, 2026Mozilla
Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
8.8 High severity
Firefox: Use After Free
CVE-2026-100797Sep 29, 2026Mozilla
Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Thunderbird: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100794Sep 29, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
7.1 High severity
Thunderbird: Access of Resource Using Incompatible Type
CVE-2026-100792Sep 29, 2026Mozilla
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100791Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100790Sep 29, 2026Mozilla
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100789Sep 29, 2026Mozilla
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.8 Critical severity
Thunderbird: Access of Uninitialized Pointer
CVE-2026-100788Sep 29, 2026Mozilla
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100786Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100785Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100784Sep 29, 2026Mozilla
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100782Sep 29, 2026Mozilla
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100781Sep 29, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100780Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100779Sep 29, 2026Mozilla
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100778Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100777Sep 29, 2026Mozilla
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Thunderbird: Use After Free
CVE-2026-100776Sep 29, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-100775Sep 29, 2026Mozilla
Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100774Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100773Sep 29, 2026Mozilla
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Thunderbird: Use After Free
CVE-2026-100772Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
8.1 High severity
Firefox: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CVE-2026-100771Sep 29, 2026Mozilla
Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100770Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Thunderbird: Use After Free
CVE-2026-100769Sep 29, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100767Sep 29, 2026Mozilla
Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100765Sep 29, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
8.8 High severity
Thunderbird: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100764Sep 29, 2026Mozilla
Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100762Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-100760Sep 29, 2026Mozilla
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
8.1 High severity
Firefox: Use of Uninitialized Variable
CVE-2026-100759Sep 29, 2026Mozilla
Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Improper Access Control
CVE-2026-100758Sep 29, 2026Mozilla
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100757Sep 29, 2026Mozilla
Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.1 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100756Sep 29, 2026Mozilla
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.1 Critical severity
Thunderbird: Out-of-bounds Read
CVE-2026-92240Sep 15, 2026Mozilla
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thu
8.1 High severity
Thunderbird: Out-of-bounds Read
CVE-2026-92239Sep 15, 2026Mozilla
A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
9.8 Critical severity
Thunderbird: Inconsistent Interpretation of HTTP Requests
CVE-2026-92238Sep 15, 2026Mozilla
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
9.1 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-92079Sep 15, 2026Mozilla
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92076Sep 15, 2026Mozilla
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
9.1 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-92075Sep 15, 2026Mozilla
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.