Mozilla Thunderbird vulnerabilities

2,511 known vulnerabilities affecting mozilla/thunderbird.

Total CVEs

2,511

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229

Vulnerabilities

SortPage 48 of 126

CVE-2026-100816P3HIGHCVSS 8.1fixed in 153.4.0≥ 154.0, < 157.02026-09-29

CVE-2026-100816 [HIGH] CWE-346 CVE-2026-100816: Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 1 Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

nvdmozilla

CVE-2026-100830P3HIGHCVSS 8.1fixed in 153.4.0≥ 154.0, < 157.02026-09-29

CVE-2026-100830 [HIGH] CWE-346 CVE-2026-100830: Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153. Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

nvdmozilla

CVE-2025-0241P3HIGHCVSS 7.7fixed in 128.6.0≥ 129.0, < 134.02025-01-07

CVE-2025-0241 [HIGH] CWE-401 CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially e When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

nvdosv

CVE-2010-3776P3CRITICALCVSS 9.3≤ 3.0.10v0.1+76 more2010-12-10

CVE-2010-3776 [CRITICAL] CWE-119 CVE-2010-3776: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.16 and 3.6. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

nvd

CVE-2018-12362P3HIGHCVSS 8.8fixed in 52.9≥ 52.9.1, < 60.0+2 more2018-10-18

CVE-2018-12362 [HIGH] CWE-190 CVE-2018-12362: An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Ext An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

nvdosv

CVE-2026-6746P3HIGHCVSS 7.5fixed in 140.10.02026-04-21

CVE-2026-6746 [HIGH] CWE-416 CVE-2026-6746: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firef Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

nvdmozilla

CVE-2024-10466P3HIGHCVSS 7.5fixed in 128.4.0≥ 129.0, < 132.0+2 more2024-10-29

CVE-2024-10466 [HIGH] CWE-400 CVE-2024-10466: By sending a specially crafted push message, a remote server could have hung the parent process, cau By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

nvdosv

CVE-2026-6758P3HIGHCVSS 7.5fixed in 150.02026-04-21

CVE-2026-6758 [HIGH] CWE-416 CVE-2026-6758: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

nvdmozilla

CVE-2026-4686P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24

CVE-2026-4686 [HIGH] CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

osv

CVE-2026-4685P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24

CVE-2026-4685 [HIGH] CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

osv

CVE-2009-2463P3CRITICALCVSS 10.0v2.0.0.0v2.0.0.1+19 more2009-07-22

CVE-2009-2463 [CRITICAL] CWE-189 CVE-2009-2463: Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/l Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspec

nvd

CVE-2023-3417P3HIGHCVSS 7.5fixed in 102.13.1≥ 115.0, < 115.0.1+2 more2023-07-24

CVE-2023-3417 [HIGH] CVE-2023-3417: Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.

nvdosv

CVE-2026-4704P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24

CVE-2026-4704 [HIGH] CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

osv

CVE-2026-4707P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24

CVE-2026-4707 [HIGH] CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

osv

CVE-2026-8949P3HIGHCVSS 7.5fixed in 140.11fixed in 151.0.02026-05-19

CVE-2026-8949 [HIGH] CWE-190 CVE-2026-8949: Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefo Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

nvdmozilla

CVE-2010-3778P3CRITICALCVSS 9.3≤ 3.0.10v0.1+73 more2010-12-10

CVE-2010-3778 [CRITICAL] CWE-119 CVE-2010-3778: Unspecified vulnerability in Mozilla Firefox 3.5.x before 3.5.16, Thunderbird before 3.0.11, and Sea Unspecified vulnerability in Mozilla Firefox 3.5.x before 3.5.16, Thunderbird before 3.0.11, and SeaMonkey before 2.0.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

nvd

CVE-2026-8946P3HIGHCVSS 7.5fixed in 140.112026-05-19

CVE-2026-8946 [HIGH] CWE-119 CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

nvdmozilla

CVE-2026-16354P3HIGHCVSS 7.5fixed in 140.13.0≥ 141.0, < 153.02026-07-21

CVE-2026-16354 [HIGH] CWE-200 CVE-2026-16354: Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdmozilla

CVE-2026-74954P3HIGHCVSS 7.5fixed in 153.1.0fixed in 154.02026-08-18

CVE-2026-74954 [HIGH] CWE-203 CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability w Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

nvdmozilla

CVE-2026-84144P3HIGHCVSS 7.5fixed in 153.2.0≥ 154.0, < 155.02026-09-01

CVE-2026-84144 [HIGH] CWE-119 CVE-2026-84144: Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showe Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

nvdmozilla

← Previous48 / 126Next →