[ CVE-2026-113869 · Published 20 Oct 2026 ]
Vulnerability in Mozilla Thunderbird
CVSS 5.4
EPSS <1%2 agency advisoriesFix available
[ Description ]Official description
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.
[ Fixes ]Fixes and patches
- Security bulletin: Mozilla mfsa2026-115Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-115, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-113Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-113, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-114Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-114, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-111Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-111, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-112Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-112, cited by CERT-FR CERTFR-2026-AVI-1346
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1346
Multiple vulnerabilities in Mozilla products Translated from French
Multiple vulnerabilities have been discovered in Mozilla products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and denial of service.
-
BSI CERT-BundWID-SEC-2026-4064
Mozilla products (Thunderbird, Firefox ESR and Firefox): Multiple vulnerabilities Translated from German