RLSA-2026:70642 (CVE-2026-16365)

Vulnerability from osv_rocky – Published: 2026-09-25 06:09 – Updated: 2026-09-25 06:14 – Source website
VLAI
Summary
Important: thunderbird security update
Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

  • firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

  • firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

  • firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

  • firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

  • firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

  • thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

  • thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

  • thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007)

  • firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029)

  • firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023)

  • thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240)

  • thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239)

  • thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits
Rocky Enterprise Software Foundation
Red Hat
References
https://errata.rockylinux.org/RLSA-2026:70642 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2503504 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2517832 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526753 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526760 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526764 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526765 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526767 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526773 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526778 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2526781 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2527113 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2527115 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2527116 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533737 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533740 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533741 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533742 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533743 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533747 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533751 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533753 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533757 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533758 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533760 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533762 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533764 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533769 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533770 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533771 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533773 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533774 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533778 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533779 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533781 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533786 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533790 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533791 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533792 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533793 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533797 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2533799 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2534187 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2534197 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2534199 REPORT
https://access.redhat.com/errata/RHSA-2026:70642 ADVISORY
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "thunderbird",
        "purl": "pkg:rpm/rocky-linux/thunderbird?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "AppStream"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:140.16.0-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:70642"
  },
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)\n\n* firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)\n\n* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)\n\n* firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)\n\n* firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)\n\n* firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-84124)\n\n* firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)\n\n* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)\n\n* thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)\n\n* thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)\n\n* thunderbird: One byte overflow read in mail parser (CVE-2026-84640)\n\n* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)\n\n* firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)\n\n* firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)\n\n* firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)\n\n* firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-92028)\n\n* firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)\n\n* firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)\n\n* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Core \u0026 HTML component (CVE-2026-92018)\n\n* firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)\n\n* firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component (CVE-2026-92030)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007)\n\n* firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025)\n\n* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029)\n\n* firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023)\n\n* thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240)\n\n* thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239)\n\n* thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:70642",
  "modified": "2026-09-25T06:14:24.043215Z",
  "published": "2026-09-25T06:09:18.596271Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:70642"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503504"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517832"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526753"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526760"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526764"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526765"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526767"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526773"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526778"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526781"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527113"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527115"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527116"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533737"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533740"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533741"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533742"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533743"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533751"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533753"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533757"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533758"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533760"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533762"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533764"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533769"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533770"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533771"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533773"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533774"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533778"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533779"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533781"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533786"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533791"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533792"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533793"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533797"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533799"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534187"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534197"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534199"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:70642"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: thunderbird security update",
  "upstream": [
    "CVE-2026-16365",
    "CVE-2026-75874",
    "CVE-2026-84119",
    "CVE-2026-84120",
    "CVE-2026-84121",
    "CVE-2026-84122",
    "CVE-2026-84124",
    "CVE-2026-84131",
    "CVE-2026-84143",
    "CVE-2026-84145",
    "CVE-2026-84639",
    "CVE-2026-84640",
    "CVE-2026-84641",
    "CVE-2026-92005",
    "CVE-2026-92006",
    "CVE-2026-92007",
    "CVE-2026-92008",
    "CVE-2026-92009",
    "CVE-2026-92010",
    "CVE-2026-92011",
    "CVE-2026-92012",
    "CVE-2026-92013",
    "CVE-2026-92014",
    "CVE-2026-92015",
    "CVE-2026-92016",
    "CVE-2026-92017",
    "CVE-2026-92018",
    "CVE-2026-92019",
    "CVE-2026-92020",
    "CVE-2026-92021",
    "CVE-2026-92022",
    "CVE-2026-92023",
    "CVE-2026-92024",
    "CVE-2026-92025",
    "CVE-2026-92026",
    "CVE-2026-92027",
    "CVE-2026-92028",
    "CVE-2026-92029",
    "CVE-2026-92030",
    "CVE-2026-92031",
    "CVE-2026-92032",
    "CVE-2026-92238",
    "CVE-2026-92239",
    "CVE-2026-92240"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.