Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-6778 CVE record

CVSS 5.3 Medium

Invalid pointer in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6777 CVE record

CVSS 5.3 Medium

Other issue in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site request forgery (CSRF)
- Denial of service
Not analysed yet 21 Apr 2026
CVE-2026-6776 CVE record

CVSS 7.8 High

Incorrect boundary conditions in the WebRTC: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6775 CVE record

CVSS 5.3 Medium

Incorrect boundary conditions in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6774 CVE record

CVSS 5.4 Medium

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Apr 2026
CVE-2026-6773 CVE record

CVSS 7.5 High

Denial-of-service due to integer overflow in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6772 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 21 Apr 2026
CVE-2026-6771 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2026-6770 CVE record

CVSS 6.5 Medium

Other issue in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Apr 2026
CVE-2026-6769 CVE record

CVSS 8.8 High

Privilege escalation in the Debugger component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Apr 2026
CVE-2026-6768 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2026-6767 CVE record

CVSS 5.3 Medium

Other issue in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6766 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 21 Apr 2026
CVE-2026-6765 CVE record

CVSS 5.3 Medium

Information disclosure in the Form Autofill component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Apr 2026
CVE-2026-6764 CVE record

CVSS 6.5 Medium

Incorrect boundary conditions in the DOM: Device Interfaces component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6763 CVE record

CVSS 6.5 Medium

Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Apr 2026
CVE-2026-6762 CVE record

CVSS 6.3 Medium

Spoofing issue in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2026-6761 CVE record

CVSS 8.8 High

Privilege escalation in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Apr 2026
CVE-2026-6760 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2026-6759 CVE record

CVSS 7.5 High

Use-after-free in the Widget: Cocoa component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6758 CVE record

CVSS 7.5 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6757 CVE record

CVSS 6.3 Medium

Invalid pointer in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6755 CVE record

CVSS 6.5 Medium

Mitigation bypass in the DOM: postMessage component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site request forgery (CSRF)
Not analysed yet 21 Apr 2026
CVE-2026-6754 CVE record

CVSS 7.5 High

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6753 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6752 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6751 CVE record

CVSS 7.3 High

Uninitialized memory in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6750 CVE record

CVSS 8.8 High

Privilege escalation in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Apr 2026
CVE-2026-6749 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6748 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Uninitialized memory in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6747 CVE record

CVSS 7.5 High

Use-after-free in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6746 CVE record

CVSS 7.5 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-5735 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Apr 2026
CVE-2026-5734 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Apr 2026
CVE-2026-5733 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Apr 2026
CVE-2026-5732 CVE record

CVSS 8.8 High

Incorrect boundary conditions, integer overflow in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Apr 2026
CVE-2026-5731 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Apr 2026
CVE-2026-4371 CVE record

CVSS 7.4 High

Out of bounds read in IMAP parsing
- Mozilla Thunderbird
- CWE-126
- CWE-130
Not analysed yet 24 Mar 2026
CVE-2026-3889 CVE record

CVSS 6.5 Medium

Spoofing issue in Thunderbird
- Mozilla Thunderbird
- CWE-451
Not analysed yet 24 Mar 2026
CVE-2026-4721 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4729 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 149 and Thunderbird 149
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4720 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4719 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4718 CVE record

CVSS 8.1 High

Undefined behavior in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-758
Not analysed yet 24 Mar 2026
CVE-2026-4728 CVE record

CVSS 6.5 Medium

Spoofing issue in the Privacy: Anti-Tracking component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 24 Mar 2026
CVE-2026-4727 CVE record

CVSS 7.5 High

Denial-of-service in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 24 Mar 2026
CVE-2026-4726 CVE record

CVSS 7.5 High

Denial-of-service in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 24 Mar 2026
CVE-2026-4717 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege escalation in the Netmonitor component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 24 Mar 2026
CVE-2026-4716 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4715 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Uninitialized memory in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4714 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4713 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4712 CVE record

CVSS 7.5 High

Information disclosure in the Widget: Cocoa component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 24 Mar 2026
CVE-2026-4725 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4711 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Widget: Cocoa component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4710 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4709 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Audio/Video: GMP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4708 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4707 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4706 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Mar 2026