Multiple vulnerabilities in Mozilla Thunderbird ESR

Description

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. Denial of service vulnerability in MIME parsing can be exploited remotely to cause denial of service.
2. Security vulnerability can be exploited to bypass security restrictions.
3. Information disclosure vulnerability can be exploited to obtain sensitive information.
4. Security vulnerability in the Remote Settings Client component can be exploited to bypass security restrictions.
5. A remote code execution vulnerability in the JavaScript: GC component can be exploited remotely to execute arbitrary code.
6. A remote code execution vulnerability in the DOM: Navigation component can be exploited remotely to execute arbitrary code.
7. A remote code execution vulnerability in the Audio/Video component can be exploited remotely to execute arbitrary code.
8. A remote code execution vulnerability in the DOM: Security component can be exploited remotely to execute arbitrary code.
9. A remote code execution vulnerability in the Graphics: WebGPU component can be exploited remotely to execute arbitrary code.
10. A remote code execution vulnerability in the DOM: Core & HTML component can be exploited remotely to execute arbitrary code.
11. Security vulnerability in the Application Update component can be exploited to bypass security restrictions.
12. Information disclosure vulnerability in the Graphics: WebGPU component can be exploited to obtain sensitive information.
13. Denial of service vulnerability in the Graphics component can be exploited remotely to cause denial of service.
14. Information disclosure vulnerability in the Networking: HTTP component can be exploited to obtain sensitive information.
15. Denial of service vulnerability in the Profile Backup component can be exploited remotely to cause denial of service.
16. Denial of service vulnerability in the DOM: Navigation component can be exploited remotely to cause denial of service.
17. Security UI vulnerability in the DOM: Core & HTML component can be exploited to spoof user interface.
18. A remote code execution vulnerability in the Graphics: ImageLib component can be exploited remotely to execute arbitrary code.

Original advisories

• MFSA2026-88

Exploitation

Public exploits exist for this vulnerability.

Related products

• Mozilla-Thunderbird-ESR

CVE list

• CVE-2026-74952
  critical
• CVE-2026-75874
  critical
• CVE-2026-84118
  high
• CVE-2026-84119
  critical
• CVE-2026-84120
  high
• CVE-2026-84121
  critical
• CVE-2026-84122
  high
• CVE-2026-84123
  critical
• CVE-2026-84124
  high
• CVE-2026-84125
  high
• CVE-2026-84129
  critical
• CVE-2026-84130
  critical
• CVE-2026-84131
  critical
• CVE-2026-84132
  critical
• CVE-2026-84133
  critical
• CVE-2026-84134
  critical
• CVE-2026-84136
  high
• CVE-2026-84137
  warning
• CVE-2026-84139
  high
• CVE-2026-84140
  critical
• CVE-2026-84141
  critical
• CVE-2026-84143
  critical
• CVE-2026-84144
  critical
• CVE-2026-84145
  critical
• CVE-2026-84637
  critical
• CVE-2026-84639
  critical
• CVE-2026-84640
  critical
• CVE-2026-84641
  critical
• CVE-2026-84642
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com