Read the docs
TI-2021-16095 Aliases CVE-2021-38495GHSA-whqc-prwr-5mvr

Out-of-bounds write in Mozilla Thunderbird

Priority MEDIUM 40CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.

Why it matters now

EPSS 0.01107 66th percentileScored 2026-11-07
Fix Fixed Thunderbird (Mozilla): 91.1Firefox ESR (Mozilla): 91.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaThunderbirdbefore 91.191.1Patch availableCNA
MozillaFirefox ESRbefore 91.191.1Patch availableCNA
  • Thunderbird VendorMozilla Affected before 91.1 Fixed in 91.1 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 91.1 Fixed in 91.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*before 91.1VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*before 91.1VulnerableMozilla
  • cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* Versions before 91.1 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 91.1 Vulnerable ·Mozilla

Remediation

  • Fix · CNA Thunderbird (Mozilla) Fixed in 91.1
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 91.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38495
  2. 2026-10-03 Alias added: GHSA-whqc-prwr-5mvr

References

Advisory 5

  • TI-2022-15364 Use after free in Mozilla Firefox CVSS 3.1CRITICAL 9.8
  • TI-2022-13633 Out-of-bounds write in Mozilla Thunderbird CVSS 3.1CRITICAL 9.8
  • TI-2021-03015 XML injection in Mozilla Firefox ESR CVSS 3.1CRITICAL 10.0
  • TI-2022-09755 Protection mechanism failure in Mozilla Firefox CVSS 3.1CRITICAL 9.6
  • TI-2022-07009 Protection mechanism failure in Mozilla Firefox CVSS 3.1CRITICAL 9.6
  • TI-2023-18834 Use after free in Mozilla Firefox CVSS 3.1HIGH 8.8
See all 486 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences