Mozilla Foundation Security Advisory 2026-95
Security Vulnerabilities fixed in Thunderbird 140.16
- Announced
- September 15, 2026
- Impact
- high
- Products
- Thunderbird
- Fixed in
-
- Thunderbird 140.16
Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-92238: Ambiguous parsing of mail headers
- Reporter
- Ramesh Adhikari, Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India)
- Impact
- medium
Description
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations.
References
#CVE-2026-92239: Buffer overrun in IMAP
- Reporter
- Ramesh Adhikari, Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India)
- Impact
- medium
Description
A maliciously constructed IMAP line could cause an out-of-bounds buffer read.
References
#CVE-2026-92240: Out-of-bounds read in IMAP response parser
- Reporter
- Ahmed Albalawi
- Impact
- low
Description
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication.
References
#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component
- Reporter
- [email protected]
- Impact
- high
References
#CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92014: Privilege escalation due to incorrect boundary conditions in the Graphics component
- Reporter
- Jacolon Walker
- Impact
- high
References
#CVE-2026-92015: Privilege escalation in the WebExtensions component
- Reporter
- Quy Pham
- Impact
- high
References
#CVE-2026-92016: Use-after-free in the Disability Access APIs component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92017: Privilege escalation in the DOM: Service Workers component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component
- Reporter
- Quy Pham
- Impact
- high
References
#CVE-2026-92019: Mitigation bypass in the Remote Settings Client component
- Reporter
- Shu Takahashi
- Impact
- high
References
#CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
- Reporter
- Rintaro Kawasugi
- Impact
- high
References
#CVE-2026-92021: Use-after-free in the JavaScript Engine: JIT component
- Reporter
- Tomer Fichman
- Impact
- high
References
#CVE-2026-92022: Use-after-free in the DOM: HTML Parser component
- Reporter
- Seohyeon Maeng
- Impact
- high
References
#CVE-2026-92023: Use-after-free in the XML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92024: Use-after-free in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92025: Use-after-free in the DOM: Navigation component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92026: Use-after-free in the Networking component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92027: Use-after-free in the DOM: Streams component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92028: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92029: Use-after-free in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
- Reporter
- anas cherni
- Impact
- moderate
References
#CVE-2026-92031: Information disclosure in the Graphics: ImageLib component
- Reporter
- Qi Qin
- Impact
- moderate
References
#CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate