Mozilla Thunderbird vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mozilla Thunderbird: 523 record(s), with affected versions and fixes.cpe:2.3:a:mozilla:thunderbird
CVE-2026-16374
High · 7.5
CWE-200 Jul 21, 2026
Information disclosure in the Framework component in DevTools
Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16372
High · 8.8
CWE-269 Jul 21, 2026
Privilege escalation in the DOM: Content Processes component
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16371
High · 8.8
CWE-269 Jul 21, 2026
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16370
Critical · 9.1
CWE-693 Jul 21, 2026
Mitigation bypass in the DOM: Networking component
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16369
Critical · 9.8
CWE-190 Jul 21, 2026
Integer overflow in the JavaScript: WebAssembly component
Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16368
Critical · 9.8
CWE-119 Jul 21, 2026
Incorrect boundary conditions in the JavaScript: WebAssembly component
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16367
Critical · 10.0
CWE-119 Jul 21, 2026
Sandbox escape due to invalid pointer in the Disability Access APIs component
Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16366
High · 8.8
CWE-269 Jul 21, 2026
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16365
High · 8.8
CWE-269 Jul 21, 2026
Privilege escalation in the DOM: Workers component
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16364
Critical · 9.1
CWE-119 Jul 21, 2026
Incorrect boundary conditions in the Audio/Video: Playback component
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16363
Critical · 9.8
CWE-682 Jul 21, 2026
JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16362
High · 8.8
CWE-416 Jul 21, 2026
Use-after-free in the WebRTC: Audio/Video component
Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16361
Critical · 9.8
CWE-119 Jul 21, 2026
Memory safety bugs fixed in Thunderbird ESR 140.13
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
CVE-2026-16360
Critical · 9.8
CWE-119 Jul 21, 2026
Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16359
Critical · 9.1
CWE-119 Jul 21, 2026
Incorrect boundary conditions in the Audio/Video: GMP component
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16358
Critical · 9.8
CWE-346 Jul 21, 2026
Site isolation issue in the Graphics: WebRender component
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16357
Critical · 9.8
CWE-119 Jul 21, 2026
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16356
Critical · 9.8
CWE-416 Jul 21, 2026
Sandbox escape due to use-after-free in the Disability Access APIs component
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16355
Critical · 9.8
CWE-843 Jul 21, 2026
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16354
High · 7.5
CWE-200 Jul 21, 2026
Information disclosure in the Graphics: ImageLib component
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16353
Critical · 9.8
CWE-416 Jul 21, 2026
Invalid pointer in the DOM: Bindings (WebIDL) component
Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16352
Critical · 9.8
CWE-416 Jul 21, 2026
Sandbox escape due to use-after-free in the Disability Access APIs component
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16351
Critical · 9.8
CWE-416 Jul 21, 2026
Sandbox escape due to use-after-free in the DOM: Navigation component
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16350
Critical · 9.8
CWE-119 Jul 21, 2026
Incorrect boundary conditions in the Audio/Video: cubeb component
Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16349
Critical · 9.8
CWE-346 Jul 21, 2026
Same-origin policy bypass in the DOM: Navigation component
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.