Mozilla Thunderbird vulnerabilities and fixes

CVEs that mention Mozilla Thunderbird, ranked by priority. 83 tracked.

Mozilla Thunderbird has 83 tracked vulnerabilities, 10 critical. A fixed release or vendor patch exists for 80. Most recent: 2026-10-20. Highest priority: CVE-2025-6424 (score 65/100).

• CVE-2025-6424 CRITICAL 9.8 UPGRADE A use-after-free in FontFaceSet resulted in a potentially exploitable crash
• CVE-2023-29531 CRITICAL 9.8 UPGRADE UPGRADE An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption an
• CVE-2023-29542 CRITICAL 9.8 UPGRADE UPGRADE A newline in a filename could have been used to bypass the file extension security mechanisms that replace mal
• CVE-2023-34416 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12
• CVE-2025-11708 CRITICAL 9.8 UPGRADE UPGRADE Use-after-free in MediaTrackGraphImpl::GetInstance()
• CVE-2025-11709 CRITICAL 9.8 UPGRADE UPGRADE A compromised web process was able to trigger out of bounds reads and writes in a more privileged process usin
• CVE-2025-11710 CRITICAL 9.8 UPGRADE UPGRADE A compromised web process using malicious IPC messages could have caused the privileged browser process to rev
• CVE-2026-5731 CRITICAL 9.8 DOWNGRADE DOWNGRADE Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.
• CVE-2026-5734 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 14
• CVE-2023-37202 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-37211 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12
• CVE-2026-5735 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1
• CVE-2023-25732 HIGH 8.8 UPGRADE UPGRADE When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded
• CVE-2023-25734 HIGH 8.1 UPGRADE UPGRADE After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a r
• CVE-2023-25735 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-25737 HIGH 8.8 UPGRADE UPGRADE An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behav
• CVE-2023-25739 HIGH 8.8 UPGRADE UPGRADE Module load requests that failed were not being checked as to whether or not they were cancelled causing a use
• CVE-2023-28162 HIGH 8.8 UPGRADE UPGRADE While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type
• CVE-2023-32214 HIGH 7.5 UPGRADE UPGRADE Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note:
• CVE-2023-0767 HIGH 8.8 UPGRADE UPGRADE An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes v
• CVE-2023-23605 HIGH 8.8 UPGRADE UPGRADE Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox
• CVE-2023-25746 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 102.7
• CVE-2023-28176 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 110 and Firefox ESR 102.8
• CVE-2023-29536 HIGH 8.8 UPGRADE UPGRADE An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled me
• CVE-2023-29539 HIGH 8.8 UPGRADE UPGRADE When handling the filename directive in the Content-Disposition header, the filename would be truncated if the
• CVE-2023-29550 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 111 and Firefox ESR 102.9
• CVE-2023-32207 HIGH 8.8 UPGRADE UPGRADE A missing delay in popup notifications could have made it possible for an attacker to trick a user into granti
• CVE-2023-32213 HIGH 8.8 UPGRADE UPGRADE When reading a file, an uninitialized value could have been used as read limit
• CVE-2023-37207 MEDIUM 6.5 UPGRADE UPGRADE A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external
• CVE-2025-10533 HIGH 8.8 UPGRADE UPGRADE Integer overflow in the SVG component
• CVE-2026-5732 HIGH 8.8 UPGRADE Incorrect boundary conditions, integer overflow in the Graphics: Text component
• CVE-2023-3600 HIGH 8.8 UPGRADE UPGRADE During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potenti
• CVE-2023-28163 MEDIUM 6.5 UPGRADE UPGRADE When downloading files through the Save As dialog on Windows with suggested filenames containing environment v
• CVE-2023-25728 MEDIUM 6.5 UPGRADE UPGRADE The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's u
• CVE-2023-25751 MEDIUM 6.5 UPGRADE UPGRADE Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritt
• CVE-2023-29535 MEDIUM 6.5 UPGRADE UPGRADE Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced
• CVE-2023-29548 MEDIUM 6.5 UPGRADE UPGRADE A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result
• CVE-2023-37208 HIGH 7.8 UPGRADE UPGRADE When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code
• CVE-2023-25738 MEDIUM 6.5 UPGRADE UPGRADE Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could
• CVE-2025-10528 HIGH 7.3 UPGRADE UPGRADE Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
• CVE-2025-10537 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
• CVE-2025-11714 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Th
• CVE-2025-11715 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
• CVE-2025-13014 HIGH 8.8 UPGRADE Use-after-free in the Audio/Video component
• CVE-2023-32206 MEDIUM 6.5 UPGRADE UPGRADE An out-of-bound read could have led to a crash in the RLBox Expat driver
• CVE-2023-32211 MEDIUM 6.5 UPGRADE UPGRADE A type checking bug would have led to invalid code being compiled
• CVE-2025-13020 HIGH 8.8 UPGRADE Use-after-free in the WebRTC: Audio/Video component
• CVE-2026-14899 HIGH 7.5 UPGRADE The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was e
• CVE-2023-1945 MEDIUM 6.5 UPGRADE UPGRADE Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially expl
• CVE-2023-23598 MEDIUM 6.5 UPGRADE UPGRADE Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs co
• CVE-2023-23599 MEDIUM 6.5 UPGRADE UPGRADE When copying a network request from the developer tools panel as a curl command the output was not being prope
• CVE-2023-25742 MEDIUM 6.5 UPGRADE UPGRADE When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to c
• CVE-2023-25752 MEDIUM 6.5 UPGRADE UPGRADE When accessing throttled streams, the count of available bytes needed to be checked in the calling function to
• CVE-2023-29545 MEDIUM 6.5 UPGRADE UPGRADE Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment
• CVE-2025-13016 HIGH 7.5 UPGRADE Incorrect boundary conditions in the JavaScript: WebAssembly component
• CVE-2023-0616 MEDIUM 6.5 UPGRADE If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to pro
• CVE-2025-10529 MEDIUM 6.5 UPGRADE UPGRADE Same-origin policy bypass in the Layout component
• CVE-2025-10532 MEDIUM 6.5 UPGRADE UPGRADE Incorrect boundary conditions in the JavaScript: GC component
• CVE-2025-11713 HIGH 8.1 UPGRADE UPGRADE Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpe
• CVE-2025-13017 HIGH 8.1 UPGRADE Same-origin policy bypass in the DOM: Notifications component
• CVE-2025-13018 HIGH 8.1 UPGRADE Mitigation bypass in the DOM: Security component
• CVE-2025-13019 HIGH 8.1 UPGRADE Same-origin policy bypass in the DOM: Workers component
• CVE-2025-6426 HIGH 8.8 UPGRADE The executable file warning did not warn users before opening files with the `terminal` extension
• CVE-2026-113866 MEDIUM 5.9 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover
• CVE-2023-0430 MEDIUM 6.5 UPGRADE Certificate OCSP revocation status was not checked when verifying S/Mime signatures
• CVE-2023-0547 MEDIUM 6.5 UPGRADE OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revo
• CVE-2023-23601 MEDIUM 6.5 UPGRADE UPGRADE Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could le
• CVE-2023-25730 MEDIUM 5.4 UPGRADE UPGRADE A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the
• CVE-2023-28164 MEDIUM 6.5 UPGRADE UPGRADE Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion an
• CVE-2025-10527 HIGH 7.1 UPGRADE UPGRADE Sandbox escape due to use-after-free in the Graphics: Canvas2D component
• CVE-2025-13012 HIGH 7.5 UPGRADE Race condition in the Graphics component
• CVE-2023-32212 MEDIUM 4.3 UPGRADE UPGRADE An attacker could have positioned a `datalist` element to obscure the address bar
• CVE-2026-113868 MEDIUM 5.3 When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challe
• CVE-2023-34414 LOW 3.1 UPGRADE UPGRADE The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protec
• CVE-2025-11711 MEDIUM 6.5 UPGRADE UPGRADE There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable
• CVE-2025-6430 MEDIUM 6.1 UPGRADE When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the
• CVE-2025-11712 MEDIUM 6.1 UPGRADE UPGRADE A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior
• CVE-2025-13013 MEDIUM 6.1 UPGRADE Mitigation bypass in the DOM: Core & HTML component
• CVE-2026-113869 MEDIUM 5.4 When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) wh
• CVE-2025-10536 MEDIUM 6.2 UPGRADE UPGRADE Information disclosure in the Networking: Cache component
• CVE-2023-29532 MEDIUM 5.5 UPGRADE UPGRADE A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing t
• CVE-2025-6425 MEDIUM 4.3 UPGRADE An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that i
• CVE-2026-113867 HIGH n/a Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas

FAQ

How do I fix Mozilla Thunderbird vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Mozilla Thunderbird being exploited right now?

None of the tracked Mozilla Thunderbird CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Mozilla Thunderbird CVE should I patch first?

CVE-2025-6424 currently ranks highest (65/100): A use-after-free in FontFaceSet resulted in a potentially exploitable crash.

← Back to latest CVEs