CVE-2026-113869
published 2026-10-20CVE-2026-113869: When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUINSUCLINAL
EPSS
0.33%
26.2th percentile
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 158.0.1 | Thunderbird 158.0.1 |
| mozilla | thunderbird | < Thunderbird 153.6 | Thunderbird 153.6 |
| mozilla | thunderbird | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt
vendor_redhat·2026-10-20·CVSS 5.4
CVE-2026-113869 [MEDIUM] CWE-825 thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt
thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt
A flaw was found in Thunderbird. When requesting a security device password, such as a smartcard PIN or Primary Password, while decrypting a Secure/Multipurpose Internet Mail Extensions (S/MIME) message, the message loading process can finish or be canceled while the prompt remains open. This premature termination frees the message decoder while it is still in use, resulting in a use-after-free memory error. An attacker could exploit this vulnerability to cause an application crash, leading to a Denial of Service (DoS), or potentially execute arbitrary code.
Mitigation: --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the applicatio
Mozilla
Mozilla Foundation Security Advisory 2026-114: CVE-2026-113869
vendor_mozilla
CVE-2026-113869 Mozilla Foundation Security Advisory 2026-114: CVE-2026-113869
Mozilla Foundation Security Advisory 2026-114
CVE: CVE-2026-113869
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158.0.1
Mozilla
Mozilla Foundation Security Advisory 2026-122: CVE-2026-113869
vendor_mozilla·CVSS 5.4
CVE-2026-113869 [MEDIUM] Mozilla Foundation Security Advisory 2026-122: CVE-2026-113869
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-113869
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
GHSA
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the
ghsa_unreviewed·2026-10-20
CVE-2026-113869 [MEDIUM] CWE-416 When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.
No detection rules found.
No public exploits indexed.
2026-10-20
Published