Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-4705 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Undefined behavior in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-758
Not analysed yet 24 Mar 2026
CVE-2026-4704 CVE record

CVSS 7.5 High

Denial-of-service in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 24 Mar 2026
CVE-2026-4724 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Undefined behavior in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-758
Not analysed yet 24 Mar 2026
CVE-2026-4723 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4702 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4722 CVE record

CVSS 8.8 High

Privilege escalation in the IPC component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 24 Mar 2026
CVE-2026-4701 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4700 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
- HTTP request smuggling
Not analysed yet 24 Mar 2026
CVE-2026-4699 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4698 CVE record

CVSS 8.8 High

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-733
Not analysed yet 24 Mar 2026
CVE-2026-4697 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4696 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4695 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4694 CVE record

CVSS 7.5 High

Incorrect boundary conditions, integer overflow in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4693 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
- CWE-823
Not analysed yet 24 Mar 2026
CVE-2026-4692 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Responsive Design Mode component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-653
Not analysed yet 24 Mar 2026
CVE-2026-4691 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4690 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4689 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4688 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-4687 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Telemetry component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-501
Not analysed yet 24 Mar 2026
CVE-2026-4686 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4685 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 24 Mar 2026
CVE-2026-4684 CVE record

CVSS 7.5 High

Race condition, use-after-free in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- Memory corruption
Not analysed yet 24 Mar 2026
CVE-2026-2807 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 148 and Thunderbird 148
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2806 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Uninitialized memory in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2805 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Invalid pointer in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2804 CVE record

CVSS 5.4 Medium

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2803 CVE record

CVSS 7.5 High

Information disclosure, mitigation bypass in the Settings UI component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-693
Not analysed yet 24 Feb 2026
CVE-2026-2802 CVE record

CVSS 4.2 Medium

Race condition in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 24 Feb 2026
CVE-2026-2801 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 24 Feb 2026
CVE-2026-2800 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Spoofing issue in the WebAuthn component in Firefox for Android
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 24 Feb 2026
CVE-2026-2799 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2798 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2797 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2796 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2795 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2793 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2792 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2791 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking: Cache component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 24 Feb 2026
CVE-2026-2790 CVE record

CVSS 8.8 High

Same-origin policy bypass in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 24 Feb 2026
CVE-2026-2789 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2788 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video: GMP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2787 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Window and Location component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2786 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2785 CVE record

CVSS 8.8 High

Invalid pointer in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2784 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 24 Feb 2026
CVE-2026-2783 CVE record

CVSS 6.5 Medium

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 24 Feb 2026
CVE-2026-2782 CVE record

CVSS 8.8 High

Privilege escalation in the Netmonitor component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 24 Feb 2026
CVE-2026-2781 CVE record

CVSS 8.8 High

Integer overflow in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2780 CVE record

CVSS 8.8 High

Privilege escalation in the Netmonitor component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 24 Feb 2026
CVE-2026-2779 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2778 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2777 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege escalation in the Messaging System component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 24 Feb 2026
CVE-2026-2776 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2775 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: HTML Parser component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 24 Feb 2026
CVE-2026-2774 CVE record

CVSS 8.8 High

Integer overflow in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2773 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Web Audio component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2772 CVE record

CVSS 8.8 High

Use-after-free in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2771 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Undefined behavior in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026