Mozilla Thunderbird vulnerabilities
2,339 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,339
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH765MEDIUM746LOW29UNKNOWN60
Vulnerabilities
Page 23 of 117
CVE-2025-11714P3HIGHCVSS 8.8fixed in 140.4.0≥ 141.0, < 144.02025-10-14
CVE-2025-11714 [HIGH] CWE-119 CVE-2025-11714: Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox
Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefo
nvdosv
CVE-2026-8972P3HIGHCVSS 8.8fixed in 151.0.02026-05-19
CVE-2026-8972 [HIGH] CWE-269 CVE-2026-8972: Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 1
Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-92006P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92006 [HIGH] CWE-120 CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2025-11715P3HIGHCVSS 8.8fixed in 140.4.0fixed in 144.02025-10-14
CVE-2025-11715 [HIGH] CWE-119 CVE-2025-11715: Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird
Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunde
nvdosv
CVE-2026-100779P3HIGHCVSS 8.8fixed in 157.0≥ 140.0, < 140.17.0+1 more2026-09-29
CVE-2026-100779 [HIGH] CWE-416 CVE-2026-100779: Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100767P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100767 [HIGH] CWE-416 CVE-2026-100767: Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4
Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100784P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100784 [HIGH] CWE-416 CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100780P3HIGHCVSS 8.8fixed in 157.0≥ 140.0, < 140.17.0+1 more2026-09-29
CVE-2026-100780 [HIGH] CWE-416 CVE-2026-100780: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100774P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100774 [HIGH] CWE-416 CVE-2026-100774: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100785P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100785 [HIGH] CWE-416 CVE-2026-100785: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100777P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100777 [HIGH] CWE-416 CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100789P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100789 [HIGH] CWE-416 CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100757P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100757 [HIGH] CWE-416 CVE-2026-100757: Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi
Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100790P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100790 [HIGH] CWE-416 CVE-2026-100790: Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-92022P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92022 [HIGH] CWE-416 CVE-2026-92022: Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firef
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92028P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92028 [HIGH] CWE-416 CVE-2026-92028: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firef
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-100769P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100769 [HIGH] CWE-416 CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100776P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100776 [HIGH] CWE-416 CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100772P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100772 [HIGH] CWE-416 CVE-2026-100772: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-92026P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92026 [HIGH] CWE-416 CVE-2026-92026: Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla