Read the docs
Red Hat Security Advisory

RHSA-2026:26269

thunderbird security update

Released 2026-06-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 22 records

TI-2026-07873 CVE-2026-8956 · GHSA-22h3-6xv6-p2px

Integer overflow in Mozilla Firefox

Priority MEDIUM 50

Integer overflow in the Networking: JAR component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00605 Published 2026-05-19 Partial fix · 140.11, 151 CWE-190
TI-2026-07383 CVE-2026-8401 · GHSA-rr5w-74h2-xqhc

Protection mechanism failure in Mozilla Firefox

Priority MEDIUM 49

Sandbox escape in the Profile Backup component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-05-12 Partial fix · 115.36, 140.11 +1 CWE-693
TI-2026-07132 CVE-2026-8094 · GHSA-5ghx-9783-29rc

Code injection in Mozilla Firefox

Priority MEDIUM 49

Other issue in the WebRTC component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00446 Published 2026-05-07 Partial fix · 140.10.2 CWE-94
TI-2026-07870 CVE-2026-8953 · GHSA-c3qv-mh67-fpxw

Use after free in Mozilla Firefox

Priority MEDIUM 44

Sandbox escape due to use-after-free in the Disability Access APIs component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00532 Published 2026-05-19 Partial fix · 115.36, 140.11 +1 CWE-416
TI-2026-07876 CVE-2026-8959 · GHSA-3x92-cxc7-h2pw

Memory corruption in Mozilla Firefox

Priority MEDIUM 43

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00417 Published 2026-05-19 Partial fix · 140.11, 151 CWE-119
TI-2026-07875 CVE-2026-8958 · GHSA-gm4c-ph85-6chj

Exposure of resource to wrong sphere in Mozilla Firefox

Priority MEDIUM 43

Information disclosure, sandbox escape in the Security: Process Sandboxing component.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00344 Published 2026-05-19 Partial fix · 140.11, 151 CWE-668
TI-2026-07874 CVE-2026-8957 · GHSA-83v4-m9qr-xgp9

Improper privilege management in Mozilla Firefox

Priority MEDIUM 40

Privilege escalation in the Enterprise Policies component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00386 Published 2026-05-19 Partial fix · 140.11, 151 CWE-269
TI-2026-07863 CVE-2026-8946 · GHSA-q9p7-4943-m5gr

Memory corruption in Mozilla Firefox

Priority MEDIUM 40

Incorrect boundary conditions in the Audio/Video: Web Codecs component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0056 Published 2026-05-19 Partial fix · 115.36, 140.11 +1 CWE-119
TI-2026-07885 CVE-2026-8968 · GHSA-g34x-mgc7-jqch

Uncontrolled resource consumption in Mozilla Firefox

Priority LOW 39

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2026-05-19 Partial fix · 140.11, 151 CWE-400
TI-2026-07871 CVE-2026-8954 · GHSA-4g4m-32hr-qwg6

Memory corruption in Mozilla Firefox

Priority LOW 39

Incorrect boundary conditions, integer overflow in the Audio/Video component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2026-05-19 Partial fix · 140.11, 151 CWE-119
TI-2026-07867 CVE-2026-8950 · GHSA-m49g-cq5x-4jmc

Origin validation error in Mozilla Firefox

Priority LOW 39

Same-origin policy bypass in the Networking: HTTP component.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00194 Published 2026-05-19 Partial fix · 140.11, 151 CWE-346
TI-2026-07864 CVE-2026-8947 · GHSA-6fhv-h367-4jc4

Use after free in Mozilla Firefox

Priority LOW 38

Use-after-free in the DOM: Bindings (WebIDL) component.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00413 Published 2026-05-19 Partial fix · 115.36, 140.11 +1 CWE-416
TI-2026-07128 CVE-2026-8090 · GHSA-4345-ccpc-8955

Use after free in Mozilla Firefox

Priority LOW 38

Use-after-free in the DOM: Networking component.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00317 Published 2026-05-07 Partial fix · 115.35.2, 140.10.2 +1 CWE-416
TI-2026-07376 CVE-2026-8388 · GHSA-6cv4-3h2g-632h

Memory corruption in Mozilla Firefox

Priority LOW 34

Incorrect boundary conditions in the JavaScript Engine: JIT component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00244 Published 2026-05-12 Partial fix · 115.36, 140.11 +1 CWE-119
TI-2026-07379 CVE-2026-8391 · GHSA-93pv-vhrf-wv64

Memory corruption in Mozilla Firefox

Priority LOW 30

Other issue in the JavaScript Engine component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00298 Published 2026-05-12 Partial fix · 115.36, 140.11 +1 CWE-119