Red Hat Security AdvisoryRHSA-2026:77627
thunderbird security update
Released 2026-10-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) thunderbird-140.15.0-1.el9_4
Fixes 13 records
Priority MEDIUM 49
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00378 · Published 2026-09-01 · Partial fix · 140.15, 153.2 +1 CWE-200
Priority MEDIUM 49
Sandbox escape in the Remote Settings Client component.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00455 · Published 2026-08-18 · Partial fix · 115.40, 140.15 +2 CWE-693
Priority MEDIUM 45
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00323 · Published 2026-09-01 · Partial fix · 140.15, 153.2 +1 CWE-457
Priority MEDIUM 43
Sandbox escape due to use-after-free in the DOM: Security component.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00319 · Published 2026-09-01 · Partial fix · 115.40, 140.15 +2 CWE-416
Priority MEDIUM 43
Sandbox escape due to use-after-free in the DOM: Navigation component.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00319 · Published 2026-09-01 · Partial fix · 115.40, 140.15 +2 CWE-416
Priority MEDIUM 40
Privilege escalation due to invalid pointer in the Graphics component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00328 · Published 2026-09-01 · Partial fix · 115.40, 140.15 +2 CWE-763
Priority MEDIUM 40
Privilege escalation in the DOM: Workers component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00278 · Published 2026-07-21 · Partial fix · 140.15, 153 CWE-269
Priority LOW 38
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00267 · Published 2026-09-01 · Partial fix · 140.15, 153.2 +1 CWE-416
Priority LOW 38
A maliciously constructed mail header could lead to a one byte read past the end of a buffer.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00263 · Published 2026-09-01 · Partial fix · 140.15, 153.2 +1 CWE-126
Priority LOW 35
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.0037 · Published 2026-09-01 · Partial fix · 115.40, 140.15 +2 CWE-119
Priority LOW 24
Use-after-free in the DOM: Core & HTML component.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.0017 · Published 2026-09-01 · Partial fix · 140.15, 153.2 +1 CWE-416
Priority LOW 24
Use-after-free in the Audio/Video component.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00214 · Published 2026-09-01 · Partial fix · 140.15, 153.2 +1 CWE-416
Priority LOW 24
Use-after-free in the Audio/Video component.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00219 · Published 2026-09-01 · Partial fix · 115.40, 140.15 +2 CWE-416
THREATIST.IORead the docs