Mozilla Foundation Security Advisory 2026-109

Security Vulnerabilities fixed in Thunderbird 158

Announced

October 13, 2026

Impact

high

Products

Thunderbird

Fixed in

Thunderbird 158

Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-110247: Integer overflow in libmime buffer growth could lead to heap corruption

Reporter: Ahmed Albalawi <ahmedalbalawij@gmail.com>
Impact: moderate

Description

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations.

References

Bug 2071621

#CVE-2026-110249: Denial-of-service in the Exchange email component

Reporter: SuyZ <nguyentuanhung1149@gmail.com>
Impact: low

Description

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours.

References

Bug 2077826

#CVE-2026-109704: Privilege escalation in the Application Update component

Reporter: Noel
Impact: high

References

Bug 2037979

#CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2040905

#CVE-2026-109706: Use-after-free in the Storage: IndexedDB component

Reporter: Mozilla
Impact: high

References

Bug 2053649

#CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2059150

#CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2059151

#CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2067976

#CVE-2026-109710: Use-after-free in the Graphics: Text component

Reporter: Mozilla
Impact: high

References

Bug 2068338

#CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2068344

#CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068420

#CVE-2026-109713: Use-after-free in the Crash Reporting component

Reporter: locust1b
Impact: high

References

Bug 2068421

#CVE-2026-109714: Incorrect boundary conditions in the Layout component

Reporter: Irvan Kurniawan
Impact: high

References

Bug 2069765

#CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073267

#CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073269

#CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component

Reporter: Mozilla
Impact: high

References

Bug 2073647

#CVE-2026-109718: Use-after-free in the XML component

Reporter: Mozilla
Impact: high

References

Bug 2073692

#CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: high

References

Bug 2073969

#CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074160

#CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074161

#CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074164

#CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074171

#CVE-2026-109724: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2074193

#CVE-2026-109725: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2074208

#CVE-2026-109726: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2074212

#CVE-2026-109727: Use-after-free in the Audio/Video component

Reporter: Mozilla
Impact: high

References

Bug 2074213

#CVE-2026-109728: Use-after-free in the DOM: Animation component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074625

#CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component

Reporter: Tomer Fichman
Impact: high

References

Bug 2074632

#CVE-2026-109730: Integer overflow in the Graphics component

Reporter: Robert Longson
Impact: high

References

Bug 2074896

#CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2075436

#CVE-2026-109732: Use-after-free in the DOM: Streams component

Reporter: Mozilla
Impact: high

References

Bug 2075998

#CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2076269

#CVE-2026-106016: Mitigation bypass in the File Handling component

Reporter: Abdulrahman Alzahrani
Impact: moderate

References

Bug 2067465

#CVE-2026-109734: Mitigation bypass in the DOM: Security component

Reporter: Mirko Brodesser
Impact: moderate

References

Bug 1926318

#CVE-2026-109735: Use-after-free in the DOM: Animation component

Reporter: Mozilla
Impact: moderate

References

Bug 2028727

#CVE-2026-109736: Frame poisoning in the Layout component

Reporter: Mozilla
Impact: moderate

References

Bug 2029784

#CVE-2026-109737: Mitigation bypass in the Enterprise Policies component

Reporter: Souma Ohsawa
Impact: moderate

References

Bug 2044525

#CVE-2026-109738: Use-after-free in the Audio/Video: Playback component

Reporter: Mozilla
Impact: moderate

References

Bug 2047722

#CVE-2026-109739: Privilege escalation in the WebExtensions component

Reporter: Tomoya Nakanishi
Impact: moderate

References

Bug 2049069

#CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: moderate

References

Bug 2057113

#CVE-2026-109741: Use-after-free in the Storage: Bucket File System component

Reporter: Mozilla
Impact: moderate

References

Bug 2058651

#CVE-2026-109742: Information disclosure in the PDF Viewer component

Reporter: Mozilla
Impact: moderate

References

Bug 2058800

#CVE-2026-109743: Privilege escalation in the Panning and Zooming component

Reporter: Mozilla
Impact: moderate

References

Bug 2059195

#CVE-2026-109744: Other issue in the DOM: File component

Reporter: Mozilla
Impact: moderate

References

Bug 2059211

#CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component

Reporter: Mozilla
Impact: moderate

References

Bug 2061784

#CVE-2026-109746: Mitigation bypass in the DOM: Security component

Reporter: hamayanhamayan
Impact: moderate

References

Bug 2063005

#CVE-2026-109747: Other issue in the Address Bar component

Reporter: Mozilla
Impact: moderate

References

Bug 2065402

#CVE-2026-109748: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: moderate

References

Bug 2067169

#CVE-2026-109749: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: moderate

References

Bug 2067174

#CVE-2026-109750: Site isolation issue in the DOM: Web Authentication component

Reporter: cl0und
Impact: moderate

References

Bug 2067571

#CVE-2026-109751: Information disclosure in the Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2068372

#CVE-2026-109752: Use-after-free in the DOM: Workers component

Reporter: Mozilla
Impact: moderate

References

Bug 2068407

#CVE-2026-109753: Incorrect boundary conditions in the Layout component

Reporter: Mozilla
Impact: moderate

References

Bug 2068441

#CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component

Reporter: Mozilla
Impact: moderate

References

Bug 2068443

#CVE-2026-109755: Sandbox escape in the DOM: Content Processes component

Reporter: Mozilla
Impact: moderate

References

Bug 2068448

#CVE-2026-109756: Privilege escalation in the DOM: Navigation component

Reporter: Mozilla
Impact: moderate

References

Bug 2069258

#CVE-2026-109757: Sandbox escape due to race condition in the Networking component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2069910

#CVE-2026-109759: Site isolation issue in the Networking component

Reporter: Myungyong Lee
Impact: moderate

References

Bug 2070252

#CVE-2026-109760: Mitigation bypass in the Networking: HTTP component

Reporter: Myungyong Lee
Impact: moderate

References

Bug 2070633

#CVE-2026-109761: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: moderate

References

Bug 2071764

#CVE-2026-109762: Incorrect boundary conditions in the SVG component

Reporter: Mozilla
Impact: moderate

References

Bug 2072438

#CVE-2026-109763: Mitigation bypass in the File Handling component

Reporter: Riku Bamba
Impact: moderate

References

Bug 2072501

#CVE-2026-109764: Mitigation bypass in the Enterprise Policies component

Reporter: HyeonSeung Kim
Impact: moderate

References

Bug 2073382

#CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: moderate

References

Bug 2073396

#CVE-2026-109766: Mitigation bypass in the Enterprise Policies component

Reporter: Souma Ohsawa
Impact: moderate

References

Bug 2074406

#CVE-2026-109767: Information disclosure in the Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2074963

#CVE-2026-109768: Denial-of-service in the Site Reports component

Reporter: Mozilla
Impact: low

References

Bug 2011368

#CVE-2026-109769: Information disclosure in the Networking: Cache component

Reporter: Mohamed Mbarek
Impact: low

References

Bug 2050313

#CVE-2026-109770: Spoofing issue in the DOM: Web Serial component

Reporter: Mozilla
Impact: low

References

Bug 2059230

#CVE-2026-109771: Information disclosure in the WebRTC: Networking component

Reporter: 5up3rh3i
Impact: low

References

Bug 2059658

#CVE-2026-109772: Same-origin policy bypass in the DevTools component

Reporter: Finn Westendorf
Impact: low

References

Bug 2066063

#CVE-2026-109773: Denial-of-service in the Sync component

Reporter: Bruno
Impact: low

References

Bug 2066094

#CVE-2026-109774: Invalid pointer, undefined behavior in the DOM: Notifications component

Reporter: zx
Impact: low

References

Bug 2067657

#CVE-2026-109775: Denial-of-service in the WebRTC component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: low

References

Bug 2068255

#CVE-2026-109776: Race condition in the XPCOM component

Reporter: Mozilla
Impact: low

References

Bug 2069395

#CVE-2026-109777: Information disclosure in the Storage: IndexedDB component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: low

References

Bug 2069638

#CVE-2026-109778: Privilege escalation in the WebExtensions component

Reporter: Mozilla
Impact: low

References

Bug 2070547

#CVE-2026-109779: Race condition in the Networking: DNS component

Reporter: Mozilla
Impact: low

References

Bug 2072048

#CVE-2026-109780: Mitigation bypass in the DOM: Core & HTML component

Reporter: Shannon Booth
Impact: low

References

Bug 2072775

#CVE-2026-109781: Denial-of-service in the Printing: Output component

Reporter: Nguyen Thanh Nguyen
Impact: low

References

Bug 2072852