Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92061 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92060 CVE record

CVSS 8.8 High

Use-after-free in the Internationalization component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92059 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the DOM: Editor component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92058 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92057 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92056 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92055 CVE record

CVSS 8.8 High

Privilege escalation in the DevTools component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92054 CVE record

CVSS 8.8 High

Privilege escalation in the Memory component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92053 CVE record

CVSS 8.8 High

Privilege escalation in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92052 CVE record

CVSS 8.8 High

Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92051 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Spoofing issue due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92050 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Sandbox escape due to race condition in the XPConnect component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 15 Sept 2026
CVE-2026-92049 CVE record

CVSS 8.8 High

Use-after-free in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92048 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92047 CVE record

CVSS 8.8 High

Privilege escalation in the Crash Reporting component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92046 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92045 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92044 CVE record

CVSS 7.5 High

Information disclosure in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-92043 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92042 CVE record

CVSS 7.5 High

Race condition in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 15 Sept 2026
CVE-2026-92041 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92040 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92039 CVE record

CVSS 6.3 Medium

Mitigation bypass in the DOM: Notifications component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92038 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92037 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the DOM: Animation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92036 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92035 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92034 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 15 Sept 2026
CVE-2026-92032 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92031 CVE record

CVSS 6.5 Medium

Information disclosure in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-92030 CVE record

CVSS 5.4 Medium

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92029 CVE record

CVSS 8.8 High

Use-after-free in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92028 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92027 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Streams component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92026 CVE record

CVSS 8.8 High

Use-after-free in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92025 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92024 CVE record

CVSS 8.8 High

Use-after-free in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92023 CVE record

CVSS 8.8 High

Use-after-free in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92022 CVE record

CVSS 8.8 High

Use-after-free in the DOM: HTML Parser component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92021 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92020 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92019 CVE record

CVSS 8.1 High

Mitigation bypass in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92018 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92017 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92016 CVE record

CVSS 8.8 High

Use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92015 CVE record

CVSS 8.8 High

Privilege escalation in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92014 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92013 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92012 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92011 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92010 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92009 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92008 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92007 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92006 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92005 CVE record

CVSS 5.3 Medium

Use-after-free in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-84642 CVE record

CVSS 7.5 High

Allowed UNC hostnames for attachments interpreted as a regular expression
- Mozilla Thunderbird
- Denial of service
Not analysed yet 1 Sept 2026
CVE-2026-84641 CVE record

CVSS 7.5 High

Information disclosure due to malicious IMAP server response
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84640 CVE record

CVSS 7.5 High

One byte overflow read in mail parser
- Mozilla Thunderbird
- CWE-126
Not analysed yet 1 Sept 2026
CVE-2026-84639 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Uninitialized memory in MIME parsing
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026