Red Hat Security AdvisoryRHSA-2026:19463
thunderbird security update
Released 2026-05-20 · Red Hat rating Important · View on Red Hat →
Fixes 26 records
Priority CRITICAL 99KEV
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.82641 · Published 2026-10-22 · Partial fix · 1.0.10, 1.1.1 +2 CWE-252
Priority MEDIUM 49
Mitigation bypass in the DOM: Security component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00309 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-288
Priority MEDIUM 49
Uninitialized memory in the Audio/Video: Web Codecs component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00399 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-457
Priority MEDIUM 41
Other issue in the Storage: IndexedDB component.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.03883 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-200
Priority MEDIUM 41
Privilege escalation in the Graphics: WebRender component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00483 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-269
Priority MEDIUM 41
Use-after-free in the DOM: Core & HTML component.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00946 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-416
Priority LOW 39
Incorrect boundary conditions in the Libraries component in NSS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0039 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-754
Priority LOW 39
Privilege escalation in the Debugger component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00226 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-269
Priority LOW 39
Privilege escalation in the Networking component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00221 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-269
Priority LOW 39
Use-after-free in the Widget: Cocoa component.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00363 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-416
Priority LOW 39
Use-after-free in the JavaScript Engine component.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00387 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-416
Priority LOW 39
Information disclosure due to uninitialized memory in the Graphics: Canvas2D component.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00403 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-908
Priority LOW 39
Use-after-free in the WebRTC component.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.004 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-416
Priority LOW 38
Incorrect boundary conditions in the Libraries component in NSS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00257 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-754
Priority LOW 38
Incorrect boundary conditions in the WebRTC component.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00306 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-119
Priority LOW 38
Uninitialized memory in the Audio/Video: Web Codecs component.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00307 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-457
Priority LOW 35
Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00499 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-125
Priority LOW 35
Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00513 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-125
Priority LOW 35
Incorrect boundary conditions in the WebRTC: Networking component.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0011 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-119
Priority LOW 34
Incorrect boundary conditions in the DOM: Device Interfaces component.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00231 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-119
Priority LOW 32
Incorrect boundary conditions in the WebRTC component.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00306 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-119
Priority LOW 29
Other issue in the Libraries component in NSS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00227 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-119
Priority LOW 29
Information disclosure in the Form Autofill component.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00215 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-359
Priority LOW 29
Invalid pointer in the JavaScript: WebAssembly component.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00489 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-824
Priority LOW 28
Mitigation bypass in the File Handling component.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00191 · Published 2026-04-21 · Partial fix · 140.10, 150 CWE-693
Priority LOW 27
Spoofing issue in the DOM: Core & HTML component.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00187 · Published 2026-04-21 · Partial fix · 115.35, 140.10 +1 CWE-290
THREATIST.IORead the docs