Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-117911 CVE record

CVSS 6.3 Medium

Use-after-free in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117910 CVE record

CVSS 7.3 High

Invalid pointer in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117909 CVE record

CVSS 6.3 Medium

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117908 CVE record

CVSS 6.3 Medium

Use-after-free in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117907 CVE record

CVSS 6.3 Medium

Use-after-free in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117906 CVE record

CVSS 6.3 Medium

Use-after-free in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117905 CVE record

CVSS 6.3 Medium

Use-after-free in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117904 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117903 CVE record

CVSS 6.3 Medium

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117902 CVE record

CVSS 6.3 Medium

Use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117901 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117900 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Editor component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117899 CVE record

CVSS 8.8 High

Use-after-free in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117898 CVE record

CVSS 6.3 Medium

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117897 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the Layout: Tables component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117896 CVE record

CVSS 6.3 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117895 CVE record

CVSS 6.3 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117894 CVE record

CVSS 5.4 Medium

Incorrect boundary conditions in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117893 CVE record

CVSS 5.4 Medium

Incorrect boundary conditions in the Security: PSM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117892 CVE record

CVSS 7.3 High

Privilege escalation due to use-after-free in the WebRTC: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117891 CVE record

CVSS 7.3 High

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117890 CVE record

CVSS 7.3 High

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117889 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117888 CVE record

CVSS 5.4 Medium

Uninitialized memory in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117887 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117886 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117885 CVE record

CVSS 6.3 Medium

Use-after-free in the Layout: Grid component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117884 CVE record

CVSS 8.8 High

Use-after-free in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117883 CVE record

CVSS 8.8 High

Use-after-free in the DOM: HTML Parser component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117882 CVE record

CVSS 6.3 Medium

Use-after-free in the Layout component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117881 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117880 CVE record

CVSS 6.3 Medium

Use-after-free in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117879 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the Layout: Tables component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117878 CVE record

CVSS 6.3 Medium

Other issue, use-after-free in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117877 CVE record

CVSS 6.3 Medium

Use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117876 CVE record

CVSS 6.3 Medium

Use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117875 CVE record

CVSS 6.3 Medium

Use-after-free in the Layout: Scrolling and Overflow component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117874 CVE record

CVSS 6.3 Medium

Use-after-free in the Internationalization component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117873 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117872 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: Standard Library component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117871 CVE record

CVSS 7.3 High

Invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117870 CVE record

CVSS 7.3 High

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117869 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Oct 2026
CVE-2026-117868 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 27 Oct 2026
CVE-2026-117867 CVE record

CVSS 7.3 High

Use-after-free in the Layout component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117866 CVE record

CVSS 7.3 High

Privilege escalation due to use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117865 CVE record

CVSS 6.3 Medium

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117864 CVE record

CVSS 8.8 High

Sandbox escape in the Form Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 27 Oct 2026
CVE-2026-117863 CVE record

CVSS 6.5 Medium

Information disclosure due to uninitialized memory in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117862 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege escalation due to incorrect boundary conditions in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117861 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 27 Oct 2026
CVE-2026-117860 CVE record

CVSS 8.1 High

Same-origin policy bypass in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 27 Oct 2026
CVE-2026-113869 CVE record

CVSS 5.4 Medium

Use-after-free in S/MIME decryption during a security device password prompt
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-113868 CVE record

CVSS 5.3 Medium

Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-113867 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Stanza injection in XMPP chat
- Mozilla Thunderbird
- CWE-116
Not analysed yet 20 Oct 2026
CVE-2026-113866 CVE record

CVSS 5.9 Medium

Account password sent unencrypted during Exchange account setup
- Mozilla Thunderbird
- CWE-523
Not analysed yet 20 Oct 2026
CVE-2026-113401 CVE record

CVSS 6.5 Medium

Denial-of-service in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 20 Oct 2026
CVE-2026-113400 CVE record

CVSS 5.4 Medium

Uninitialized memory in the Audio/Video: cubeb component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-113399 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 20 Oct 2026
CVE-2026-113470 CVE record

CVSS 5.4 Medium

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
- Mozilla Firefox
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 20 Oct 2026