Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Thunderbird could let attackers run code or view emails

published 1 month ago

Summary

The Thunderbird email program contains several flaws that could allow a malicious website or email to execute code on a user's computer, see private messages, or gain higher system privileges. These issues affect the way Thunderbird handles graphics, extensions, and data storage. Install the latest Thunderbird update as soon as possible to protect your communications.

What to do

Update rocky thunderbird to version 0:140.14.0-1.el9_8.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:9	rocky	thunderbird	< 0:140.14.0-1.el9_8 Fix: upgrade to 0:140.14.0-1.el9_8

Original advisory text

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934)

* firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987)

* firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943)

* firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971)

* firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965)

* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946)

* firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973)

* firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949)

* firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990)

* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940)

* firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960)

* firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976)

* firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974)

* firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957)

* firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942)

* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939)

* firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972)

* firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945)

* firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-74944)

* firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962)

* firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:65158 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517820 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517823 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517826 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517831 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517834 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517835 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517836 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517837 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517839 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517841 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517845 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517849 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517851 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517853 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517856 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517859 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517860 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517862 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517863 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517866 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517868 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517872 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517874 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:65158 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.5 High

Timeline

Published9 Sep 2026

Updated9 Sep 2026

First seen9 Sep 2026

Sources

RLSA-2026:65158 · OSV

Track software like this

Free during beta