Mozilla Thunderbird vulnerabilities

CVE-2009-2466 [CRITICAL] CWE-787 CVE-2009-2466: The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to ca The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and js_LockGCThingRT.

CVE-2022-38476 [HIGH] CWE-416 CVE-2022-38476: A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-aft A data race could occur in the PK11_ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2.

CVE-2024-5702 [HIGH] CWE-416 CVE-2024-5702: Memory corruption in the networking stack could have led to a potentially exploitable crash. This vu Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.

CVE-2026-4694 [HIGH] CWE-190 CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fi Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-4695 [HIGH] CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2026-4697 [HIGH] CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2022-22741 [HIGH] CVE-2022-22741: When resizing a popup while requesting fullscreen access, the popup would have become unable to leav When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2024-1552 [HIGH] CWE-681 CVE-2024-1552: Incorrect code generation could have led to unexpected numeric conversions and potential undefined b Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

CVE-2022-26387 [HIGH] CWE-367 CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the u When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

CVE-2024-8383 [HIGH] CVE-2024-8383: Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default,

CVE-2024-10459 [HIGH] CWE-416 CVE-2024-10459: An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentia An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.

CVE-2026-4726 [HIGH] CWE-400 CVE-2026-4726: Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

CVE-2026-16409 [HIGH] CWE-824 CVE-2026-16409: Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thun Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2016-1953 [HIGH] CWE-119 CVE-2016-1953: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remo Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.

CVE-2025-1012 [HIGH] CWE-416 CVE-2025-1012: A race during concurrent delazification could have led to a use-after-free. This vulnerability was f A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

CVE-2026-4708 [HIGH] CVE-2026-4708: Incorrect boundary conditions in the Graphics component Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2026-4714 [HIGH] CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component Incorrect boundary conditions in the Audio/Video component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2026-4713 [HIGH] CVE-2026-4713: Incorrect boundary conditions in the Graphics component Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2026-4719 [HIGH] CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component Incorrect boundary conditions in the Graphics: Text component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2026-74966 [HIGH] CWE-359 CVE-2026-74966: Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.