Mozilla Thunderbird vulnerabilities

CVE-2024-9401 [CRITICAL] CWE-119 CVE-2024-9401: Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 12 Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thu

CVE-2024-8384 [CRITICAL] CWE-787 CVE-2024-8384: The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were de The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

CVE-2026-2805 [CRITICAL] CWE-824 CVE-2026-2805: Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and T Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

CVE-2025-9179 [CRITICAL] CWE-119 CVE-2025-9179: An attacker was able to perform memory corruption in the GMP process which processes encrypted media An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.1

CVE-2025-8028 [CRITICAL] CWE-1332 CVE-2025-8028: On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1

CVE-2025-1017 [CRITICAL] CWE-787 CVE-2025-1017: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thun

CVE-2025-14326 [CRITICAL] CWE-416 CVE-2025-14326: Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Th Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.

CVE-2025-8043 [CRITICAL] CWE-451 CVE-2025-8043: Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerabil Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.

CVE-2013-0768 [CRITICAL] CWE-787 CVE-2013-0768: Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML document that specifies invalid width and height values.

CVE-2025-11719 [CRITICAL] CWE-416 CVE-2025-11719: Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

CVE-2026-16411 Mozilla Foundation Security Advisory 2026-71: CVE-2026-16411 Mozilla Foundation Security Advisory 2026-71 CVE: CVE-2026-16411 Product: Thunderbird Impact: high Fixed in: Thunderbird 153

CVE-2014-1514 [CRITICAL] CWE-787 CVE-2014-1514: vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird bef vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by trig

CVE-2026-16406 Mozilla Foundation Security Advisory 2026-71: CVE-2026-16406 Mozilla Foundation Security Advisory 2026-71 CVE: CVE-2026-16406 Product: Thunderbird Impact: high Fixed in: Thunderbird 153

CVE-2026-109704 Mozilla Foundation Security Advisory 2026-109: CVE-2026-109704 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109704 Product: Thunderbird Impact: low Fixed in: Thunderbird 158

CVE-2026-100781 [CRITICAL] CWE-119 CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulne Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-92018 [CRITICAL] CWE-693 CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firef Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92035 [CRITICAL] CWE-119 CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability wa Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100794 [CRITICAL] CWE-119 CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vuln Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

CVE-2026-92032 [CRITICAL] CWE-119 CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Fir Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-109705 [CRITICAL] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109705 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109705 Product: Thunderbird Impact: low Fixed in: Thunderbird 158