Vulnerabilidades do Mozilla Thunderbird

CVE-2026-100766 Média · 4.3 CWE-200 29/09/2026

Information disclosure in the Networking: JAR component

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100765 Alta · 8.8 CWE-416 29/09/2026

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2026-100764 Alta · 8.8 CWE-119 29/09/2026

Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component

Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVE-2026-100763 Crítica · 9.1 CWE-119 29/09/2026

Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVE-2026-100762 Crítica · 9.6 CWE-416 29/09/2026

Sandbox escape due to use-after-free in the DOM: Content Processes component

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100767 Alta · 8.8 CWE-416 29/09/2026

Use-after-free in the Networking: Cache component

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100756 Alta · 8.1 CWE-119 29/09/2026

Incorrect boundary conditions in the Audio/Video: Playback component

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-92240 Crítica · 9.1 CWE-125 15/09/2026

Out-of-bounds Read em Mozilla Thunderbird

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92239 Alta · 8.1 CWE-125 15/09/2026

Out-of-bounds Read em Mozilla Thunderbird

A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92238 Crítica · 9.8 CWE-444 15/09/2026

HTTP Request Smuggling em Mozilla Thunderbird

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92079 Crítica · 9.1 CWE-693 15/09/2026

Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in…

Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92078 Média · 6.5 CWE-770 15/09/2026

Allocation of Resources Without Limits or Throttling em Mozilla Firefox

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92077 Média · 6.5 CWE-770 15/09/2026

Allocation of Resources Without Limits or Throttling em Mozilla Firefox

Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92076 Alta · 8.8 CWE-119 15/09/2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox

Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92075 Crítica · 9.1 CWE-693 15/09/2026

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox…

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92074 Alta · 8.8 CWE-693 15/09/2026

Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in…

Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92073 Alta · 8.8 CWE-269 15/09/2026

Improper Privilege Management em Mozilla Firefox

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92072 Alta · 8.0 CWE-119 15/09/2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox

Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92071 Crítica · 9.6 CWE-119 15/09/2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92070 Média · 4.3 CWE-200 15/09/2026

Exposure of Sensitive Information em Mozilla Firefox

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92069 Média · 5.4 CWE-451 15/09/2026

Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox…

Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92068 Média · 5.4 CWE-346 15/09/2026

Site isolation issue in the Reader Mode component. This vulnerability was fixed in…

Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92067 Alta · 8.8 CWE-416 15/09/2026

Use After Free em Mozilla Firefox

Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92066 Crítica · 9.8 CWE-693 15/09/2026

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox…

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

CVE-2026-92065 Alta · 8.8 CWE-119 15/09/2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.