Mozilla Thunderbird vulnerabilities
2,511 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,511
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229
Vulnerabilities
Page 54 of 126
CVE-2025-9180P3HIGHCVSS 8.1fixed in 128.14.0fixed in 142.0+1 more2025-08-19
CVE-2025-9180 [HIGH] CWE-346 CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firef
Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
nvdosv
CVE-2026-74962P3HIGHCVSS 8.1fixed in 140.14.0≥ 141.0, < 153.1.02026-08-18
CVE-2026-74962 [HIGH] CWE-346 CVE-2026-74962: Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 1
Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74981P3HIGHCVSS 8.1fixed in 153.1.02026-08-18
CVE-2026-74981 [HIGH] CWE-346 CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firef
Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-100809P3HIGHCVSS 8.1fixed in 153.4.0≥ 154.0, < 157.02026-09-29
CVE-2026-100809 [HIGH] CWE-346 CVE-2026-100809: Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
nvdmozilla
CVE-2020-6814P3CRITICALCVSS 9.8fixed in 68.6.0≥ unspecified, < 68.62020-03-25
CVE-2020-6814 [CRITICAL] CWE-787 CVE-2020-6814: Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of thes
Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
nvdosv
CVE-2017-7804P3HIGHCVSS 7.5fixed in 52.3.0≥ unspecified, < 52.32018-06-11
CVE-2017-7804 [HIGH] CWE-20 CVE-2017-7804: The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. Note: This attack only affects Windows operating systems. Other operating
nvd
CVE-2026-6770P3MEDIUMCVSS 6.5fixed in 140.10.02026-04-21
CVE-2026-6770 [MEDIUM] CWE-200 CVE-2026-6770: Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefo
Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
nvdmozilla
CVE-2025-59375P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2025-09-15
CVE-2025-59375 [HIGH] CVE-2025-59375: libexpat in Expat before 2
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
osv
CVE-2017-7753P3CRITICALCVSS 9.1fixed in 52.3.0≥ unspecified, < 52.32018-06-11
CVE-2017-7753 [CRITICAL] CWE-125 CVE-2017-7753: An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, usi
An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
nvdosv
CVE-2012-3980P3CRITICALCVSS 9.3≤ 14.0v1.0+98 more2012-08-29
CVE-2012-3980 [CRITICAL] CWE-94 CVE-2012-3980: The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 1
The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation.
nvd
CVE-2026-4693P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24
CVE-2026-4693 [HIGH] CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
osv
CVE-2026-4699P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24
CVE-2026-4699 [HIGH] CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
osv
CVE-2024-1936P3HIGHCVSS 7.5fixed in 115.8.1≥ unspecified, < 115.8.12024-03-04
CVE-2024-1936 [HIGH] CWE-922 CVE-2024-1936: The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitr
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message cont
nvdosv
CVE-2024-3852P3HIGHCVSS 7.5fixed in 115.10≥ unspecified, < 115.102024-04-16
CVE-2024-3852 [HIGH] CWE-386 CVE-2024-3852: GetBoundName could return the wrong version of an object when JIT optimizations were applied. This v
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
nvdosv
CVE-2026-74977P3HIGHCVSS 7.5fixed in 153.1.02026-08-18
CVE-2026-74977 [HIGH] CWE-190 CVE-2026-74977: Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74982P3HIGHCVSS 7.5fixed in 153.1.02026-08-18
CVE-2026-74982 [HIGH] CWE-400 CVE-2026-74982: Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR
Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-4709P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24
CVE-2026-4709 [HIGH] CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
osv
CVE-2026-4706P3HIGHCVSS 7.5≥ 0, < 1:140.9.0esr-1~deb11u1≥ 0, < 1:140.9.0esr-1~deb12u1+2 more2026-03-24
CVE-2026-4706 [HIGH] CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
osv
CVE-2006-0748P3CRITICALCVSS 9.3v1.0v1.0.1+8 more2006-04-14
CVE-2006-0748 [CRITICAL] CWE-399 CVE-2006-0748: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.
Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index.
nvdosv
CVE-2026-74958P3HIGHCVSS 7.5fixed in 153.1.0fixed in 154.02026-08-18
CVE-2026-74958 [HIGH] CWE-1021 CVE-2026-74958: Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox
Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla