Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8661 vulnerabilities by mozilla
CERTFR-2026-AVI-1361
Vulnerability from certfr_avis - Published: 2026-10-22 - Updated: 2026-10-22
Une vulnérabilité a été découverte dans les produits Mozilla. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox versions ant\u00e9rieures \u00e0 158.0.2 pour Android",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-113470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113470"
}
],
"initial_release_date": "2026-10-22T00:00:00",
"last_revision_date": "2026-10-22T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1361",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Mozilla. Elle permet \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-116",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-116/"
}
]
}
CERTFR-2026-AVI-1346
Vulnerability from certfr_avis - Published: 2026-10-21 - Updated: 2026-10-21
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Thunderbird | Thunderbird versions antérieures à 153.5.1 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.43.1 | ||
| Mozilla | Firefox | Firefox versions antérieures à 158.0.1 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 158.0.1 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 153.5.1 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 153.5.1",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.43.1",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox versions ant\u00e9rieures \u00e0 158.0.1",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 158.0.1",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 153.5.1",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-113400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113400"
},
{
"name": "CVE-2026-113470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113470"
},
{
"name": "CVE-2026-113868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113868"
},
{
"name": "CVE-2026-113867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113867"
},
{
"name": "CVE-2026-113866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113866"
},
{
"name": "CVE-2026-113401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113401"
},
{
"name": "CVE-2026-113399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113399"
},
{
"name": "CVE-2026-113869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113869"
}
],
"initial_release_date": "2026-10-21T00:00:00",
"last_revision_date": "2026-10-21T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1346",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-10-20",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-115",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/"
},
{
"published_at": "2026-10-20",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-113",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-113/"
},
{
"published_at": "2026-10-20",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-114",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-114/"
},
{
"published_at": "2026-10-20",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-111",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/"
},
{
"published_at": "2026-10-20",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-112",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/"
}
]
}
CERTFR-2026-AVI-1305
Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Firefox | Firefox versions antérieures à 158 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.43 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 153.5 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 158 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 153.5 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox versions ant\u00e9rieures \u00e0 158",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.43",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 153.5",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 158",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 153.5",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-109779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109779"
},
{
"name": "CVE-2026-109710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109710"
},
{
"name": "CVE-2026-109719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109719"
},
{
"name": "CVE-2026-109735",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109735"
},
{
"name": "CVE-2026-109730",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109730"
},
{
"name": "CVE-2026-109721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109721"
},
{
"name": "CVE-2026-109715",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109715"
},
{
"name": "CVE-2026-109727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109727"
},
{
"name": "CVE-2026-109775",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109775"
},
{
"name": "CVE-2026-109717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109717"
},
{
"name": "CVE-2026-109761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109761"
},
{
"name": "CVE-2026-109772",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109772"
},
{
"name": "CVE-2026-109746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109746"
},
{
"name": "CVE-2026-109774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109774"
},
{
"name": "CVE-2026-109723",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109723"
},
{
"name": "CVE-2026-109749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109749"
},
{
"name": "CVE-2026-109764",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109764"
},
{
"name": "CVE-2026-109753",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109753"
},
{
"name": "CVE-2026-109751",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109751"
},
{
"name": "CVE-2026-109781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109781"
},
{
"name": "CVE-2026-109736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109736"
},
{
"name": "CVE-2026-109750",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109750"
},
{
"name": "CVE-2026-109707",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109707"
},
{
"name": "CVE-2026-109706",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109706"
},
{
"name": "CVE-2026-109713",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109713"
},
{
"name": "CVE-2026-109720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109720"
},
{
"name": "CVE-2026-109708",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109708"
},
{
"name": "CVE-2026-109728",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109728"
},
{
"name": "CVE-2026-110247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110247"
},
{
"name": "CVE-2026-109748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109748"
},
{
"name": "CVE-2026-109732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109732"
},
{
"name": "CVE-2026-109741",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109741"
},
{
"name": "CVE-2026-109729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109729"
},
{
"name": "CVE-2026-109722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109722"
},
{
"name": "CVE-2026-109783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109783"
},
{
"name": "CVE-2026-109754",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109754"
},
{
"name": "CVE-2026-109759",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109759"
},
{
"name": "CVE-2026-109773",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109773"
},
{
"name": "CVE-2026-109711",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109711"
},
{
"name": "CVE-2026-109770",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109770"
},
{
"name": "CVE-2026-109704",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109704"
},
{
"name": "CVE-2026-109724",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109724"
},
{
"name": "CVE-2026-109714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109714"
},
{
"name": "CVE-2026-109771",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109771"
},
{
"name": "CVE-2026-109765",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109765"
},
{
"name": "CVE-2026-109726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109726"
},
{
"name": "CVE-2026-109716",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109716"
},
{
"name": "CVE-2026-109705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109705"
},
{
"name": "CVE-2026-109767",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109767"
},
{
"name": "CVE-2026-109734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109734"
},
{
"name": "CVE-2026-109733",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109733"
},
{
"name": "CVE-2026-109778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109778"
},
{
"name": "CVE-2026-109782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109782"
},
{
"name": "CVE-2026-109757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109757"
},
{
"name": "CVE-2026-109756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109756"
},
{
"name": "CVE-2026-109769",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109769"
},
{
"name": "CVE-2026-109709",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109709"
},
{
"name": "CVE-2026-109725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109725"
},
{
"name": "CVE-2026-109766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109766"
},
{
"name": "CVE-2026-109763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109763"
},
{
"name": "CVE-2026-106016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106016"
},
{
"name": "CVE-2026-109742",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109742"
},
{
"name": "CVE-2026-109743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109743"
},
{
"name": "CVE-2026-109740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109740"
},
{
"name": "CVE-2026-110249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110249"
},
{
"name": "CVE-2026-109755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109755"
},
{
"name": "CVE-2026-109780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109780"
},
{
"name": "CVE-2026-109762",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109762"
},
{
"name": "CVE-2026-109760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109760"
},
{
"name": "CVE-2026-109744",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109744"
},
{
"name": "CVE-2026-109747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109747"
},
{
"name": "CVE-2026-109737",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109737"
},
{
"name": "CVE-2026-109752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109752"
},
{
"name": "CVE-2026-109776",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109776"
},
{
"name": "CVE-2026-109745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109745"
},
{
"name": "CVE-2026-109768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109768"
},
{
"name": "CVE-2026-109712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109712"
},
{
"name": "CVE-2026-109777",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109777"
},
{
"name": "CVE-2026-109718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109718"
},
{
"name": "CVE-2026-109731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109731"
},
{
"name": "CVE-2026-109739",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109739"
},
{
"name": "CVE-2026-109738",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109738"
}
],
"initial_release_date": "2026-10-14T00:00:00",
"last_revision_date": "2026-10-14T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1305",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-10-13",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-107",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-107/"
},
{
"published_at": "2026-10-13",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-106",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/"
},
{
"published_at": "2026-10-13",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-109",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/"
},
{
"published_at": "2026-10-13",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-110",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-110/"
},
{
"published_at": "2026-10-13",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-108",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/"
}
]
}
CVE-2026-113869 (GCVE-0-2026-113869)
Vulnerability from nvd – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:42
VLAI
EPSS
VEX
Title
Use-after-free in S/MIME decryption during a security device password prompt
Summary
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:42 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:42:14.775611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:42:17.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Stefan Tatschner"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1."
}
],
"value": "When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:55.862Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075530"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Use-after-free in S/MIME decryption during a security device password prompt"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113869",
"datePublished": "2026-10-20T19:14:55.862Z",
"dateReserved": "2026-10-20T19:14:55.700Z",
"dateUpdated": "2026-10-20T19:42:17.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113868 (GCVE-0-2026-113868)
Vulnerability from nvd – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:46
VLAI
EPSS
VEX
Title
Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
Summary
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:41 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:41:15.207684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:41:19.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Tuan Hung (VNU HCM - UIT)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server\u0027s challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"value": "When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server\u0027s challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:46:39.812Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076569"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
}
],
"title": "Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113868",
"datePublished": "2026-10-20T19:14:55.520Z",
"dateReserved": "2026-10-20T19:14:55.281Z",
"dateUpdated": "2026-10-20T19:46:39.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113867 (GCVE-0-2026-113867)
Vulnerability from nvd – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:46
VLAI
EPSS
VEX
Title
Stanza injection in XMPP chat
Summary
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user\u0027s connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird\u0027s chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"value": "Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user\u0027s connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird\u0027s chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:46:39.051Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080073"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
}
],
"title": "Stanza injection in XMPP chat"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113867",
"datePublished": "2026-10-20T19:14:55.002Z",
"dateReserved": "2026-10-20T19:14:54.838Z",
"dateUpdated": "2026-10-20T19:46:39.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113866 (GCVE-0-2026-113866)
Vulnerability from nvd – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:46
VLAI
EPSS
VEX
Title
Account password sent unencrypted during Exchange account setup
Summary
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:35 UTC
CWE
- CWE-523 - Unprotected Transport of Credentials
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:35:34.601906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-523",
"description": "CWE-523 Unprotected Transport of Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:35:37.854Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When setting up an account, Thunderbird\u0027s Exchange AutoDiscover lookup also queried the domain\u0027s AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user\u0027s password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"value": "When setting up an account, Thunderbird\u0027s Exchange AutoDiscover lookup also queried the domain\u0027s AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user\u0027s password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:46:38.284Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080121"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
}
],
"title": "Account password sent unencrypted during Exchange account setup"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113866",
"datePublished": "2026-10-20T19:14:54.646Z",
"dateReserved": "2026-10-20T19:14:54.467Z",
"dateUpdated": "2026-10-20T19:46:38.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113470 (GCVE-0-2026-113470)
Vulnerability from nvd – Published: 2026-10-20 12:58 – Updated: 2026-10-21 19:20
VLAI
EPSS
VEX
Title
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
Summary
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:29 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.43.1 , ≤ 115.*
(rpm)
Unaffected: 153.5.1 , ≤ 153.* (rpm) Unaffected: 158.0.1 , ≤ 158.* (rpm) Unaffected: 158.0.2 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113470",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:29:36.088300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:29:39.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-21T14:08:25.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/20/30"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00041.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.43.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "158.*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.2",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Wayne"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2."
}
],
"value": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T19:20:41.189Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2084311"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-112/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-113/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-116/"
}
],
"title": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113470",
"datePublished": "2026-10-20T12:58:14.250Z",
"dateReserved": "2026-10-20T08:27:10.793Z",
"dateUpdated": "2026-10-21T19:20:41.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113401 (GCVE-0-2026-113401)
Vulnerability from nvd – Published: 2026-10-20 12:58 – Updated: 2026-10-20 19:14
VLAI
EPSS
VEX
Title
Denial-of-service in the PDF Viewer component
Summary
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:25 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:25:14.357154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:25:17.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Hesham"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"value": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:54.271Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073714"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Denial-of-service in the PDF Viewer component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113401",
"datePublished": "2026-10-20T12:58:16.245Z",
"dateReserved": "2026-10-20T06:00:59.236Z",
"dateUpdated": "2026-10-20T19:14:54.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113400 (GCVE-0-2026-113400)
Vulnerability from nvd – Published: 2026-10-20 12:58 – Updated: 2026-10-20 19:14
VLAI
EPSS
VEX
Title
Uninitialized memory in the Audio/Video: cubeb component
Summary
Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:26 UTC
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:26:01.525640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:26:06.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"value": "Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:53.886Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2061768"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Uninitialized memory in the Audio/Video: cubeb component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113400",
"datePublished": "2026-10-20T12:58:15.589Z",
"dateReserved": "2026-10-20T06:00:56.437Z",
"dateUpdated": "2026-10-20T19:14:53.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113399 (GCVE-0-2026-113399)
Vulnerability from nvd – Published: 2026-10-20 12:58 – Updated: 2026-10-20 19:14
VLAI
EPSS
VEX
Title
Incorrect boundary conditions in the SVG component
Summary
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:53.086Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079938"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Incorrect boundary conditions in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113399",
"datePublished": "2026-10-20T12:58:14.968Z",
"dateReserved": "2026-10-20T06:00:54.207Z",
"dateUpdated": "2026-10-20T19:14:53.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110249 (GCVE-0-2026-110249)
Vulnerability from nvd – Published: 2026-10-13 18:08 – Updated: 2026-10-21 17:25
VLAI
EPSS
VEX
Title
Denial-of-service in the Exchange email component
Summary
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:01 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:01:59.034534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:02:04.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "SuyZ"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird\u0027s main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5."
}
],
"value": "A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird\u0027s main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:25:10.583Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077826"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Denial-of-service in the Exchange email component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-110249",
"datePublished": "2026-10-13T18:08:38.179Z",
"dateReserved": "2026-10-13T18:08:37.893Z",
"dateUpdated": "2026-10-21T17:25:10.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110247 (GCVE-0-2026-110247)
Vulnerability from nvd – Published: 2026-10-13 18:08 – Updated: 2026-10-21 17:25
VLAI
EPSS
VEX
Title
Integer overflow in libmime buffer growth could lead to heap corruption
Summary
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:08 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
158 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:08:54.337976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:09:29.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Albalawi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158."
}
],
"value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:25:34.486Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071621"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
}
],
"title": "Integer overflow in libmime buffer growth could lead to heap corruption"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-110247",
"datePublished": "2026-10-13T18:08:37.608Z",
"dateReserved": "2026-10-13T18:08:37.322Z",
"dateUpdated": "2026-10-21T17:25:34.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109783 (GCVE-0-2026-109783)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
VLAI
EPSS
VEX
Title
Mitigation bypass in the File Handling component
Summary
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.5 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
}
],
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:17:24.062Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075533"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Mitigation bypass in the File Handling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109783",
"datePublished": "2026-10-13T12:29:36.256Z",
"dateReserved": "2026-10-13T00:49:22.774Z",
"dateUpdated": "2026-10-13T18:17:24.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109782 (GCVE-0-2026-109782)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
VLAI
EPSS
VEX
Title
Mitigation bypass in the File Handling component
Summary
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.5 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Abdulrahman Alzahrani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
}
],
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:17:09.475Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067465"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Mitigation bypass in the File Handling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109782",
"datePublished": "2026-10-13T12:29:36.025Z",
"dateReserved": "2026-10-13T00:49:20.493Z",
"dateUpdated": "2026-10-13T18:17:09.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109781 (GCVE-0-2026-109781)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
VLAI
EPSS
VEX
Title
Denial-of-service in the Printing: Output component
Summary
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:21 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109781",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:21:45.441870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:21:50.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Thanh Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
}
],
"value": "Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:17:30.187Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072852"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Denial-of-service in the Printing: Output component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109781",
"datePublished": "2026-10-13T12:29:35.824Z",
"dateReserved": "2026-10-13T00:49:18.273Z",
"dateUpdated": "2026-10-13T18:17:30.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109780 (GCVE-0-2026-109780)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
VLAI
EPSS
VEX
Title
Mitigation bypass in the DOM: Core & HTML component
Summary
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Shannon Booth"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
}
],
"value": "Mitigation bypass in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:08:36.500Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072775"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
}
],
"title": "Mitigation bypass in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109780",
"datePublished": "2026-10-13T12:29:35.608Z",
"dateReserved": "2026-10-13T00:49:15.410Z",
"dateUpdated": "2026-10-13T18:08:36.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109779 (GCVE-0-2026-109779)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
VLAI
EPSS
VEX
Title
Race condition in the Networking: DNS component
Summary
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:53 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:53:48.294735Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:53:51.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
}
],
"value": "Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:08:35.924Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072048"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
}
],
"title": "Race condition in the Networking: DNS component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109779",
"datePublished": "2026-10-13T12:29:35.359Z",
"dateReserved": "2026-10-13T00:49:13.115Z",
"dateUpdated": "2026-10-13T18:08:35.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109778 (GCVE-0-2026-109778)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-14 03:59
VLAI
EPSS
VEX
Title
Privilege escalation in the WebExtensions component
Summary
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 00:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109778",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:59:03.757Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
}
],
"value": "Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:17:29.200Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2070547"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Privilege escalation in the WebExtensions component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109778",
"datePublished": "2026-10-13T12:29:35.148Z",
"dateReserved": "2026-10-13T00:49:10.870Z",
"dateUpdated": "2026-10-14T03:59:03.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109777 (GCVE-0-2026-109777)
Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
VLAI
EPSS
VEX
Title
Information disclosure in the Storage: IndexedDB component
Summary
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:56 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:56:02.265281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:56:28.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Shu Takahashi of Velcore Consulting Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
}
],
"value": "Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:17:28.186Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2069638"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Information disclosure in the Storage: IndexedDB component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-109777",
"datePublished": "2026-10-13T12:29:34.941Z",
"dateReserved": "2026-10-13T00:49:08.777Z",
"dateUpdated": "2026-10-13T18:17:28.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113869 (GCVE-0-2026-113869)
Vulnerability from cvelistv5 – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:42
VLAI
EPSS
VEX
Title
Use-after-free in S/MIME decryption during a security device password prompt
Summary
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:42 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:42:14.775611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:42:17.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Stefan Tatschner"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1."
}
],
"value": "When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:55.862Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075530"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Use-after-free in S/MIME decryption during a security device password prompt"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113869",
"datePublished": "2026-10-20T19:14:55.862Z",
"dateReserved": "2026-10-20T19:14:55.700Z",
"dateUpdated": "2026-10-20T19:42:17.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113868 (GCVE-0-2026-113868)
Vulnerability from cvelistv5 – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:46
VLAI
EPSS
VEX
Title
Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
Summary
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:41 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:41:15.207684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:41:19.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Tuan Hung (VNU HCM - UIT)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server\u0027s challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"value": "When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server\u0027s challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:46:39.812Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076569"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
}
],
"title": "Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113868",
"datePublished": "2026-10-20T19:14:55.520Z",
"dateReserved": "2026-10-20T19:14:55.281Z",
"dateUpdated": "2026-10-20T19:46:39.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113867 (GCVE-0-2026-113867)
Vulnerability from cvelistv5 – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:46
VLAI
EPSS
VEX
Title
Stanza injection in XMPP chat
Summary
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user\u0027s connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird\u0027s chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"value": "Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user\u0027s connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird\u0027s chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:46:39.051Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080073"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
}
],
"title": "Stanza injection in XMPP chat"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113867",
"datePublished": "2026-10-20T19:14:55.002Z",
"dateReserved": "2026-10-20T19:14:54.838Z",
"dateUpdated": "2026-10-20T19:46:39.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113866 (GCVE-0-2026-113866)
Vulnerability from cvelistv5 – Published: 2026-10-20 19:14 – Updated: 2026-10-20 19:46
VLAI
EPSS
VEX
Title
Account password sent unencrypted during Exchange account setup
Summary
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:35 UTC
CWE
- CWE-523 - Unprotected Transport of Credentials
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:35:34.601906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-523",
"description": "CWE-523 Unprotected Transport of Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:35:37.854Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When setting up an account, Thunderbird\u0027s Exchange AutoDiscover lookup also queried the domain\u0027s AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user\u0027s password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"value": "When setting up an account, Thunderbird\u0027s Exchange AutoDiscover lookup also queried the domain\u0027s AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user\u0027s password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:46:38.284Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080121"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
}
],
"title": "Account password sent unencrypted during Exchange account setup"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113866",
"datePublished": "2026-10-20T19:14:54.646Z",
"dateReserved": "2026-10-20T19:14:54.467Z",
"dateUpdated": "2026-10-20T19:46:38.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113401 (GCVE-0-2026-113401)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 19:14
VLAI
EPSS
VEX
Title
Denial-of-service in the PDF Viewer component
Summary
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:25 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:25:14.357154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:25:17.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Hesham"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"value": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:54.271Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073714"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Denial-of-service in the PDF Viewer component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113401",
"datePublished": "2026-10-20T12:58:16.245Z",
"dateReserved": "2026-10-20T06:00:59.236Z",
"dateUpdated": "2026-10-20T19:14:54.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113400 (GCVE-0-2026-113400)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 19:14
VLAI
EPSS
VEX
Title
Uninitialized memory in the Audio/Video: cubeb component
Summary
Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:26 UTC
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:26:01.525640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:26:06.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"value": "Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:53.886Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2061768"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Uninitialized memory in the Audio/Video: cubeb component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113400",
"datePublished": "2026-10-20T12:58:15.589Z",
"dateReserved": "2026-10-20T06:00:56.437Z",
"dateUpdated": "2026-10-20T19:14:53.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113399 (GCVE-0-2026-113399)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 19:14
VLAI
EPSS
VEX
Title
Incorrect boundary conditions in the SVG component
Summary
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
158.0.1 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:14:53.086Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079938"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
}
],
"title": "Incorrect boundary conditions in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113399",
"datePublished": "2026-10-20T12:58:14.968Z",
"dateReserved": "2026-10-20T06:00:54.207Z",
"dateUpdated": "2026-10-20T19:14:53.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113470 (GCVE-0-2026-113470)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-21 19:20
VLAI
EPSS
VEX
Title
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
Summary
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:29 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.43.1 , ≤ 115.*
(rpm)
Unaffected: 153.5.1 , ≤ 153.* (rpm) Unaffected: 158.0.1 , ≤ 158.* (rpm) Unaffected: 158.0.2 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.5.1 , ≤ 153.*
(rpm)
Unaffected: 158.0.1 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113470",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:29:36.088300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:29:39.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-21T14:08:25.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/20/30"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00041.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.43.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "158.*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.2",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Wayne"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2."
}
],
"value": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T19:20:41.189Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2084311"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-112/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-113/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-114/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-115/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-116/"
}
],
"title": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113470",
"datePublished": "2026-10-20T12:58:14.250Z",
"dateReserved": "2026-10-20T08:27:10.793Z",
"dateUpdated": "2026-10-21T19:20:41.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110249 (GCVE-0-2026-110249)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:08 – Updated: 2026-10-21 17:25
VLAI
EPSS
VEX
Title
Denial-of-service in the Exchange email component
Summary
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:01 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
153.5 , ≤ 153.*
(rpm)
Unaffected: 158 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:01:59.034534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:02:04.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "SuyZ"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird\u0027s main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5."
}
],
"value": "A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird\u0027s main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:25:10.583Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077826"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
}
],
"title": "Denial-of-service in the Exchange email component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-110249",
"datePublished": "2026-10-13T18:08:38.179Z",
"dateReserved": "2026-10-13T18:08:37.893Z",
"dateUpdated": "2026-10-21T17:25:10.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110247 (GCVE-0-2026-110247)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:08 – Updated: 2026-10-21 17:25
VLAI
EPSS
VEX
Title
Integer overflow in libmime buffer growth could lead to heap corruption
Summary
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:08 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
158 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:08:54.337976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:09:29.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Albalawi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158."
}
],
"value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:25:34.486Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071621"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
}
],
"title": "Integer overflow in libmime buffer growth could lead to heap corruption"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-110247",
"datePublished": "2026-10-13T18:08:37.608Z",
"dateReserved": "2026-10-13T18:08:37.322Z",
"dateUpdated": "2026-10-21T17:25:34.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}