Red Hat Security Advisory

RHSA-2026:81884

thunderbird security update

Released 2026-10-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird-140.16.0-1.el9_6

Fixes 31 records

TI-2026-62271 CVE-2026-92238 · GHSA-w2rw-r9p8-wp72

Ambiguous parsing of mail headers

MEDIUM 50

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00539 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-444

TI-2026-62273 CVE-2026-92240 · GHSA-wq87-gp3m-ww5v

Out-of-bounds read in IMAP response parser

MEDIUM 48

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00628 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-125

TI-2026-62161 CVE-2026-92032 · GHSA-58hr-q7r3-8jw3

Memory corruption in Mozilla Firefox

MEDIUM 43

Sandbox escape due to invalid pointer in the Graphics component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00321 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-119

TI-2026-62147 CVE-2026-92018 · GHSA-f8x3-g25f-rfqc

Protection mechanism failure in Mozilla Firefox

MEDIUM 43

Sandbox escape in the DOM: Core & HTML component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00328 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-693

TI-2026-62158 CVE-2026-92029 · GHSA-fcjq-ffhg-m7hf

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the SVG component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62157 CVE-2026-92028 · GHSA-qm5r-cp4c-rchw

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the DOM: Core & HTML component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62156 CVE-2026-92027 · GHSA-65cr-9wxj-vw4g

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the DOM: Streams component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62155 CVE-2026-92026 · GHSA-4gpp-v4j5-5hhg

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the Networking component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00312 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-416

TI-2026-62154 CVE-2026-92025 · GHSA-3gpp-x4f4-w8m4

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the DOM: Navigation component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62153 CVE-2026-92024 · GHSA-hv2v-8fc2-jwf6

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the SVG component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62152 CVE-2026-92023 · GHSA-85j7-39hr-qwr2

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the XML component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62151 CVE-2026-92022 · GHSA-gcxv-gv82-5hp5

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the DOM: HTML Parser component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00319 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-416

TI-2026-62150 CVE-2026-92021 · GHSA-8gpq-5x64-h429

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the JavaScript Engine: JIT component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00282 Published 2026-09-15 Partial fix · 140.16 CWE-416

TI-2026-62149 CVE-2026-92020 · GHSA-rmcw-j32j-ffq6

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62146 CVE-2026-92017 · GHSA-jq8g-rpr7-39xm

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the DOM: Service Workers component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00239 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-269

TI-2026-62145 CVE-2026-92016 · GHSA-5rcc-wmxq-mppm

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the Disability Access APIs component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00312 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-416

TI-2026-62144 CVE-2026-92015 · GHSA-7j9r-93j5-qmvf

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the WebExtensions component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0026 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-269

TI-2026-62143 CVE-2026-92014 · GHSA-mqr4-65f4-xr47

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00239 Published 2026-09-15 Partial fix · 115.41, 140.16 CWE-120

TI-2026-62142 CVE-2026-92013 · GHSA-mmqw-6cvj-pjr5

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62141 CVE-2026-92012 · GHSA-3pq7-6j4j-pqf7

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62140 CVE-2026-92011 · GHSA-pjx8-577g-gcqp

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62139 CVE-2026-92010 · GHSA-hc8m-hgr8-3grq

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62138 CVE-2026-92009 · GHSA-7p38-76rq-878j

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62137 CVE-2026-92008 · GHSA-3rpr-7wjf-f32w

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62136 CVE-2026-92007 · GHSA-q8rx-2j8f-jqmv

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62135 CVE-2026-92006 · GHSA-vhhq-94j2-336v

Buffer overflow in Mozilla Firefox

MEDIUM 40

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00328 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-120

TI-2026-62272 CVE-2026-92239 · GHSA-3f4g-x8c6-4887

Buffer overrun in IMAP

LOW 37

A maliciously constructed IMAP line could cause an out-of-bounds buffer read.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00406 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-125

TI-2026-62148 CVE-2026-92019 · GHSA-6gh2-567v-rrg3

Protection mechanism failure in Mozilla Firefox

LOW 37

Mitigation bypass in the Remote Settings Client component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00307 Published 2026-09-15 Partial fix · 115.41, 140.16 +2 CWE-693

TI-2026-62134 CVE-2026-92005 · GHSA-c7h2-74jc-fjxf

Use after free in Mozilla Firefox

LOW 30

Use-after-free in the Audio/Video: Web Codecs component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00357 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-416

TI-2026-62160 CVE-2026-92031 · GHSA-542f-vpqh-r4pj

Information disclosure in Mozilla Firefox

LOW 29

Information disclosure in the Graphics: ImageLib component.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00306 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-200

TI-2026-62159 CVE-2026-92030 · GHSA-f3p4-m566-r2fg

Protection mechanism failure in Mozilla Firefox

LOW 24

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00218 Published 2026-09-15 Partial fix · 140.16, 153.3 +1 CWE-693