Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-100794 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Internationalization component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100793 CVE record

CVSS 6.5 Medium

JIT miscompilation in the JavaScript Engine component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100792 CVE record

CVSS 7.1 High

JIT miscompilation in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100791 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100790 CVE record

CVSS 8.8 High

Use-after-free in the XSLT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100789 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100788 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Invalid pointer in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100787 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the XUL component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 29 Sept 2026
CVE-2026-100786 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100785 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100784 CVE record

CVSS 8.8 High

Use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100783 CVE record

CVSS 4.3 Medium

Uninitialized memory in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100782 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100781 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100780 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100779 CVE record

CVSS 8.8 High

Use-after-free in the XSLT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100778 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100777 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100776 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100775 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100774 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100773 CVE record

CVSS 8.8 High

Use-after-free in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100772 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100771 CVE record

CVSS 8.1 High

Undefined behavior in the DOM: Streams component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-758
Not analysed yet 29 Sept 2026
CVE-2026-100770 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100769 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100768 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100767 CVE record

CVSS 8.8 High

Use-after-free in the Networking: Cache component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100766 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 29 Sept 2026
CVE-2026-100765 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100764 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100763 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100762 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100761 CVE record

CVSS 8.8 High

Privilege escalation due to use-after-free in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100760 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100759 CVE record

CVSS 8.1 High

Uninitialized memory in the Storage: Quota Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100758 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-100757 CVE record

CVSS 8.8 High

Use-after-free in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100756 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-92240 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Out-of-bounds read in IMAP response parser
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92239 CVE record

CVSS 8.1 High

Buffer overrun in IMAP
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92238 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Ambiguous parsing of mail headers
- Mozilla Thunderbird
- HTTP request smuggling
Not analysed yet 15 Sept 2026
CVE-2026-92079 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92078 CVE record

CVSS 6.5 Medium

Denial-of-service in the Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-92077 CVE record

CVSS 6.5 Medium

Denial-of-service in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-92076 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92075 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92074 CVE record

CVSS 8.8 High

Mitigation bypass in the Popup Blocker component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92073 CVE record

CVSS 8.8 High

Privilege escalation in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92072 CVE record

CVSS 8.0 High

Incorrect boundary conditions in the Safe Browsing component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92071 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92070 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-92069 CVE record

CVSS 5.4 Medium

Spoofing issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 15 Sept 2026
CVE-2026-92068 CVE record

CVSS 5.4 Medium

Site isolation issue in the Reader Mode component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 15 Sept 2026
CVE-2026-92067 CVE record

CVSS 8.8 High

Use-after-free in the Widget: Gtk component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92066 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape in the Profile Backup component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92065 CVE record

CVSS 8.8 High

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92064 CVE record

CVSS 8.8 High

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92063 CVE record

CVSS 6.5 Medium

Denial-of-service in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-92062 CVE record

CVSS 8.8 High

Privilege escalation in the Session Restore component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026