Mozilla Thunderbird vulnerabilities

CVE-2026-57962 [MEDIUM] CWE-400 CVE-2026-57962: A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomple A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

CVE-2026-12329 [MEDIUM] CWE-119 CVE-2026-12329: Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.1 Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.

CVE-2026-12307 [MEDIUM] CWE-119 CVE-2026-12307: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-12308 [MEDIUM] CWE-119 CVE-2026-12308: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-12306 [MEDIUM] CWE-119 CVE-2026-12306: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-6767 [MEDIUM] CWE-119 CVE-2026-6767: Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE-2026-6765 [MEDIUM] CWE-359 CVE-2026-6765: Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE-2009-0776 [HIGH] CWE-200 CVE-2009-0776: nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1 nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.

CVE-2008-5506 [MEDIUM] CWE-264 CVE-2008-5506: Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMo Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a 302 redirect to a resource in a different domain, then reading content from

CVE-2026-113868 Mozilla Foundation Security Advisory 2026-114: CVE-2026-113868 Mozilla Foundation Security Advisory 2026-114 CVE: CVE-2026-113868 Product: Thunderbird Impact: low Fixed in: Thunderbird 158.0.1

CVE-2011-2980 [HIGH] CVE-2011-2980: Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox befor Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded into the running Firefox process.

CVE-2026-118010 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118010 Mozilla Foundation Security Advisory 2026-121 CVE: CVE-2026-118010 Product: Thunderbird Impact: low Fixed in: Thunderbird 159

CVE-2015-0807 [MEDIUM] CVE-2015-0807: The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6 The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted w

CVE-2011-3666 [MEDIUM] CVE-2011-3666: Mozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar files t Mozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar files to be executable files, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted file. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-2372 on Mac OS X.

CVE-2021-23973 [MEDIUM] CWE-209 CVE-2021-23973: When trying to load a cross-origin resource in an audio/video context a decoding error may have resu When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

CVE-2020-6795 [MEDIUM] CWE-476 CVE-2020-6795: When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing cod When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects Thunderbird < 68.5.

CVE-2020-15648 [MEDIUM] CWE-1021 CVE-2020-15648: Using object or embed tags, it was possible to frame other websites, even if they disallowed framing Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.

CVE-2020-6798 [MEDIUM] CWE-79 CVE-2020-6798: If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsin If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because

CVE-2019-11739 [MEDIUM] CWE-319 CVE-2019-11739: Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included i Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9.

CVE-2022-22760 [MEDIUM] CWE-209 CVE-2022-22760: When importing resources using Web Workers, error messages would distinguish the difference between When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.