Mozilla Thunderbird vulnerabilities

CVE-2025-8033 [MEDIUM] CWE-476 CVE-2025-8033: The JavaScript engine did not handle closed generators correctly and it was possible to resume them The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

CVE-2023-4580 [MEDIUM] CWE-311 CVE-2023-4580: Push notifications stored on disk in private browsing mode were not being encrypted potentially allo Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

CVE-2026-92063 [MEDIUM] CWE-770 CVE-2026-92063: Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thun Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

CVE-2023-0547 [MEDIUM] CWE-295 CVE-2023-0547: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10.

CVE-2023-0430 [MEDIUM] CWE-295 CVE-2023-0430: Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed wit Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1.

CVE-2024-8394 [MEDIUM] CWE-416 CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-fre When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

CVE-2026-109775 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109775 Mozilla Foundation Security Advisory 2026-110 CVE: CVE-2026-109775 Product: Thunderbird Impact: low Fixed in: Thunderbird 153.5

CVE-2026-109781 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109781 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109781 Product: Thunderbird Impact: low Fixed in: Thunderbird 158

CVE-2026-100826 [MEDIUM] CWE-770 CVE-2026-100826: Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2026-92078 [MEDIUM] CWE-770 CVE-2026-92078: Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ES Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-3889 [MEDIUM] CWE-451 CVE-2026-3889: Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9 Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

CVE-2024-2610 [MEDIUM] CWE-94 CVE-2024-2610: Using a markup injection an attacker could have stolen nonce values. This could have been used to by Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVE-2006-3809 [HIGH] CVE-2006-3809: Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows script Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows scripts with the UniversalBrowserRead privilege to gain UniversalXPConnect privileges and possibly execute code or obtain sensitive data by reading into a privileged context.

CVE-2024-9397 [MEDIUM] CWE-1021 CVE-2024-9397: A missing delay in directory upload UI could have made it possible for an attacker to trick a user i A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVE-2024-3859 [MEDIUM] CWE-125 CVE-2024-3859: On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially c On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVE-2011-0071 [MEDIUM] CWE-22 CVE-2011-0071: Directory traversal vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, Thunderb Directory traversal vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 on Windows allows remote attackers to determine the existence of arbitrary files, and possibly load resources, via vectors involving a resource: URL.

CVE-2018-18509 [MEDIUM] CWE-347 CVE-2018-18509: A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird

CVE-2008-1237 [MEDIUM] CWE-399 CVE-2008-1237: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13 Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.

CVE-2008-1380 [CRITICAL] CVE-2008-1380: The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service (garbage collector crash) and possibly have other impacts via a crafted web page. NOTE: this is due to an incorrect fix for CVE-2008-1237.

CVE-2025-0237 [MEDIUM] CWE-863 CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check t The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.