Red Hat Security Advisory

RHSA-2026:20586

thunderbird security update

Released 2026-05-26 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2026-07129 CVE-2026-8091 · GHSA-jx5x-3wf9-9rhg

MEDIUM 49

Incorrect boundary conditions in the Audio/Video: Playback component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00469 Published 2026-05-07 Partial fix · 115.35.2, 140.10.1 +1 CWE-754

TI-2026-06428 CVE-2026-7321 · GHSA-jjvw-q2ff-g9g3

MEDIUM 42

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00258 Published 2026-04-28 Partial fix · 140.10.1, 150 CWE-120

TI-2026-06430 CVE-2026-7323 · GHSA-9wpv-xc33-5cm6

MEDIUM 40

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00375 Published 2026-04-28 Partial fix · 140.10.1, 150.0.1 CWE-119

TI-2026-06429 CVE-2026-7322 · GHSA-xhr8-9mw2-3mf4

MEDIUM 40

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00316 Published 2026-04-28 Partial fix · 115.35.1, 140.10.1 +1 CWE-119

TI-2026-06427 CVE-2026-7320 · GHSA-fpr3-wjv4-wj6q

LOW 39

Information disclosure due to incorrect boundary conditions in the Audio/Video component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00323 Published 2026-04-28 Partial fix · 115.35.1, 140.10.1 +1 CWE-119