Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-110249 CVE record

CVSS 8.6 High

Denial-of-service in the Exchange email component
- Mozilla Thunderbird
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-110247 CVE record

CVSS 8.4 High

Integer overflow in libmime buffer growth could lead to heap corruption
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109783 CVE record

CVSS 8.3 High

Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109782 CVE record

CVSS 8.3 High

Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109781 CVE record

CVSS 6.5 Medium

Denial-of-service in the Printing: Output component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-109780 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109779 CVE record

CVSS 4.2 Medium

Race condition in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 13 Oct 2026
CVE-2026-109778 CVE record

CVSS 8.8 High

Privilege escalation in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 13 Oct 2026
CVE-2026-109777 CVE record

CVSS 4.3 Medium

Information disclosure in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-109776 CVE record

CVSS 4.2 Medium

Race condition in the XPCOM component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 13 Oct 2026
CVE-2026-109775 CVE record

CVSS 6.5 Medium

Denial-of-service in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-109774 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Invalid pointer, undefined behavior in the DOM: Notifications component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109773 CVE record

CVSS 6.5 Medium

Denial-of-service in the Sync component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-109772 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the DevTools component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 13 Oct 2026
CVE-2026-109771 CVE record

CVSS 4.3 Medium

Information disclosure in the WebRTC: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-109770 CVE record

CVSS 6.1 Medium

Spoofing issue in the DOM: Web Serial component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-109769 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking: Cache component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-109768 CVE record

CVSS 6.5 Medium

Denial-of-service in the Site Reports component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-109767 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-109766 CVE record

CVSS 8.1 High

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109765 CVE record

CVSS 4.2 Medium

Race condition, use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109764 CVE record

CVSS 5.4 Medium

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109763 CVE record

CVSS 5.4 Medium

Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-109762 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109761 CVE record

CVSS 5.4 Medium

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109760 CVE record

CVSS 8.1 High

Mitigation bypass in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109759 CVE record

CVSS 8.1 High

Site isolation issue in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 13 Oct 2026
CVE-2026-109757 CVE record

CVSS 8.3 High

Sandbox escape due to race condition in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 13 Oct 2026
CVE-2026-109756 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 13 Oct 2026
CVE-2026-109755 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109754 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the DOM: Editor component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109752 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109751 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-109750 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Web Authentication component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109749 CVE record

CVSS 5.4 Medium

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109748 CVE record

CVSS 5.4 Medium

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109747 CVE record

CVSS 7.3 High

Other issue in the Address Bar component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 13 Oct 2026
CVE-2026-109746 CVE record

CVSS 7.3 High

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109745 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to uninitialized memory in the DOM: Web Serial component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109744 CVE record

CVSS 8.1 High

Other issue in the DOM: File component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109743 CVE record

CVSS 8.8 High

Privilege escalation in the Panning and Zooming component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 13 Oct 2026
CVE-2026-109742 CVE record

CVSS 4.3 Medium

Information disclosure in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-109741 CVE record

CVSS 5.4 Medium

Use-after-free in the Storage: Bucket File System component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109740 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109739 CVE record

CVSS 8.8 High

Privilege escalation in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 13 Oct 2026
CVE-2026-109738 CVE record

CVSS 5.4 Medium

Use-after-free in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109737 CVE record

CVSS 8.1 High

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109736 CVE record

CVSS 8.1 High

Frame poisoning in the Layout component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 13 Oct 2026
CVE-2026-109735 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Animation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109734 CVE record

CVSS 8.1 High

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Oct 2026
CVE-2026-109731 CVE record

CVSS 5.4 Medium

Incorrect boundary conditions in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109724 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109723 CVE record

CVSS 5.4 Medium

Integer overflow in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109721 CVE record

CVSS 5.4 Medium

Incorrect boundary conditions in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109720 CVE record

CVSS 7.1 High

JIT miscompilation in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109717 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Bindings (WebIDL) component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109714 CVE record

CVSS 5.4 Medium

Incorrect boundary conditions in the Layout component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109713 CVE record

CVSS 5.4 Medium

Use-after-free in the Crash Reporting component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109711 CVE record

CVSS 5.4 Medium

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109709 CVE record

CVSS 8.8 High

Information disclosure, privilege escalation in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Oct 2026