CVEvulnerability
CVE-2026-92238
9.8 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-15
- Last modified
- 2026-09-24
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-444
Description
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected configurations
• mozilla thunderbird (< 140.16.0)
• mozilla thunderbird (>= 141.0 < 153.3.0)
• mozilla thunderbird (>= 154.0 < 156.0)
Related
Weakness · CWE (1)
- CWE-444 Inconsistent Interpretation of HTTP Requests weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2060601 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-94/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-95/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-96/ Vendor Advisory