Vulnerability-Lookup

ALSA-2026:65159

Vulnerability from osv_almalinux – Published: 2026-09-08 00:00 – Updated: 2026-09-09 08:05 – Source website

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934)
firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953)
firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987)
firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948)
firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971)
firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973)
firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990)
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936)
firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960)
firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959)
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976)
firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974)
firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957)
firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942)
firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939)
firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972)
firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945)
firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963)
firefox: Integer overflow in the Graphics component (CVE-2026-74964)
firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962)
firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:65159	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-74934	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74935	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74936	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74939	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74942	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74945	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74948	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74953	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74957	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74959	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74960	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74962	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74963	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74964	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74971	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74972	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74973	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74974	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74976	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74987	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74990	REPORT
	https://bugzilla.redhat.com/2517820	REPORT
	https://bugzilla.redhat.com/2517822	REPORT
	https://bugzilla.redhat.com/2517823	REPORT
	https://bugzilla.redhat.com/2517825	REPORT
	https://bugzilla.redhat.com/2517831	REPORT
	https://bugzilla.redhat.com/2517836	REPORT
	https://bugzilla.redhat.com/2517839	REPORT
	https://bugzilla.redhat.com/2517840	REPORT
	https://bugzilla.redhat.com/2517845	REPORT
	https://bugzilla.redhat.com/2517849	REPORT
	https://bugzilla.redhat.com/2517851	REPORT
	https://bugzilla.redhat.com/2517853	REPORT
	https://bugzilla.redhat.com/2517856	REPORT
	https://bugzilla.redhat.com/2517859	REPORT
	https://bugzilla.redhat.com/2517860	REPORT
	https://bugzilla.redhat.com/2517862	REPORT
	https://bugzilla.redhat.com/2517863	REPORT
	https://bugzilla.redhat.com/2517866	REPORT
	https://bugzilla.redhat.com/2517870	REPORT
	https://bugzilla.redhat.com/2517872	REPORT
	https://bugzilla.redhat.com/2517874	REPORT
	https://errata.almalinux.org/10/ALSA-2026-65159.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.14.0-1.el10_2.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934)\n  * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953)\n  * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987)\n  * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948)\n  * firefox: thunderbird: Information disclosure in the DOM: UI Events \u0026 Focus Handling component (CVE-2026-74971)\n  * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973)\n  * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990)\n  * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936)\n  * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960)\n  * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976)\n  * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974)\n  * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957)\n  * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939)\n  * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972)\n  * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963)\n  * firefox: Integer overflow in the Graphics component (CVE-2026-74964)\n  * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962)\n  * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:65159",
  "modified": "2026-09-09T08:05:57Z",
  "published": "2026-09-08T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:65159"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74934"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74935"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74936"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74939"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74942"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74945"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74948"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74953"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74957"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74959"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74960"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74962"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74963"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74964"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74971"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74972"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74973"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74974"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74976"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74987"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74990"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517820"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517822"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517823"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517825"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517831"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517836"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517839"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517840"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517845"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517849"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517851"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517853"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517856"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517859"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517860"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517862"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517863"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517866"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517870"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517872"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517874"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-65159.html"
    }
  ],
  "related": [
    "CVE-2026-74934",
    "CVE-2026-74953",
    "CVE-2026-74987",
    "CVE-2026-74948",
    "CVE-2026-74971",
    "CVE-2026-74973",
    "CVE-2026-74990",
    "CVE-2026-74936",
    "CVE-2026-74960",
    "CVE-2026-74959",
    "CVE-2026-74976",
    "CVE-2026-74974",
    "CVE-2026-74957",
    "CVE-2026-74942",
    "CVE-2026-74939",
    "CVE-2026-74972",
    "CVE-2026-74945",
    "CVE-2026-74963",
    "CVE-2026-74964",
    "CVE-2026-74962",
    "CVE-2026-74935"
  ],
  "summary": "Important: thunderbird security update"
}

CVE-2026-74990 (GCVE-0-2026-74990)

Vulnerability from cvelistv5 – Published: 2026-08-18 12:23 – Updated: 2026-09-01 21:25

Title

Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154

Summary

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 19:27 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla mitre root

References

9 references

URL	Tags
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2…
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.39 , ≤ 115.* (rpm) Unaffected: 140.14 , ≤ 140.* (rpm) Unaffected: 153.1 , ≤ 153.* (rpm) Unaffected: 154 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.14 , ≤ 140.* (rpm) Unaffected: 153.1 , ≤ 153.* (rpm) Unaffected: 154 , ≤ * (rpm)

Credits

Christian Holler, Jan de Mooij, Tom Ritter and the Mozilla Fuzzing Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-74990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:27:52.706061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:28:52.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.39",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.14",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.1",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "154",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.14",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.1",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "154",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Christian Holler, Jan de Mooij, Tom Ritter and the Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."
            }
          ],
          "value": "Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T21:25:07.797Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "Moderate Severity internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045762%2C2052401%2C2058208"
        },
        {
          "name": "High Severity internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045774%2C2048490%2C2050864%2C2053159%2C2053260%2C2053261%2C2053582%2C2053599%2C2053607%2C2053608%2C2053853%2C2054626%2C2054627%2C2054635%2C2054677%2C2054740%2C2054832%2C2056792%2C2057098%2C2057100%2C2057101%2C2057103%2C2057117%2C2057118%2C2058048%2C2058049%2C2058622%2C2058623%2C2058665%2C2058666%2C2059121%2C2059164%2C2059188"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-74/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-75/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-77/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-78/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-80/"
        }
      ],
      "title": "Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-74990",
    "datePublished": "2026-08-18T12:23:35.129Z",
    "dateReserved": "2026-08-17T11:59:24.147Z",
    "dateUpdated": "2026-09-01T21:25:07.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.