RHSA-2026:81913

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

Sandbox escape in the Remote Settings Client component.

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird.

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.

Sandbox escape due to invalid pointer in the Graphics component.

Sandbox escape in the DOM: Core & HTML component.

Sandbox escape due to use-after-free in the DOM: Security component.

Sandbox escape due to use-after-free in the DOM: Navigation component.

Use-after-free in the SVG component.

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the DOM: Streams component.

Use-after-free in the Networking component.

Use-after-free in the DOM: Navigation component.

Use-after-free in the SVG component.

Use-after-free in the XML component.

Use-after-free in the DOM: HTML Parser component.

Use-after-free in the JavaScript Engine: JIT component.

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.

Privilege escalation in the DOM: Service Workers component.

Use-after-free in the Disability Access APIs component.

Privilege escalation in the WebExtensions component.

Privilege escalation due to incorrect boundary conditions in the Graphics component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation due to invalid pointer in the Graphics component.

Privilege escalation in the DOM: Workers component.

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response.

A maliciously constructed mail header could lead to a one byte read past the end of a buffer.

A maliciously constructed IMAP line could cause an out-of-bounds buffer read.

Mitigation bypass in the Remote Settings Client component.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

Use-after-free in the Audio/Video: Web Codecs component.

Information disclosure in the Graphics: ImageLib component.

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the Audio/Video component.

Use-after-free in the Audio/Video component.