RLSA-2026:19348 — Important: thunderbird security update

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)

* firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)

* firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)

* firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

Release	Package	Fixed in
Rocky Linux · 9	thunderbird	0:140.10.1-1.el9_8

Vulnerabilities 29

Critical 9.8

CVE-2026-6748

Uninitialized memory in the Audio/Video: Web Codecs component

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Critical 9.8

CVE-2026-6771

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Critical 9.6

CVE-2026-7321

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Wolfi

Apr 28, 2026
High 8.8

CVE-2026-6750

Privilege escalation in the Graphics: WebRender component

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 8.8

CVE-2026-6761

Privilege escalation in the Networking component

Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 8.8

CVE-2026-6769

Privilege escalation in the Debugger component

Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.8

CVE-2026-6776

Incorrect boundary conditions in the WebRTC: Networking component

Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6746

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6747

Use-after-free in the WebRTC component

Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6749

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6754

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6759

Use-after-free in the Widget: Cocoa component

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6766

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6772

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6785

Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6786

Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-7320

Information disclosure due to incorrect boundary conditions in the Audio/Video component

Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 28, 2026
High 7.3

CVE-2026-6751

Uninitialized memory in the Audio/Video: Web Codecs component

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.3

CVE-2026-6752

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.3

CVE-2026-6753

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.3

CVE-2026-7322

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability wa…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 28, 2026
High 7.3

CVE-2026-7323

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability wa…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 28, 2026
Medium 6.5

CVE-2026-6763

Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.5

CVE-2026-6764

Incorrect boundary conditions in the DOM: Device Interfaces component

Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.5

CVE-2026-6770 Public exploit

Other issue in the Storage: IndexedDB component

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.3

CVE-2026-6757

Invalid pointer in the JavaScript: WebAssembly component

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.3

CVE-2026-6762

Spoofing issue in the DOM: Core & HTML component

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 5.3

CVE-2026-6765 Public exploit

Information disclosure in the Form Autofill component

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 5.3

CVE-2026-6767

Other issue in the Libraries component in NSS

Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2460074
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460075
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460076
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460078
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460079
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460085
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460086
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460088
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460092
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460094
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460095
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460096
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460097
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460099
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460101
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460102
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460103
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460104
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460105
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460106
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460107
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460108
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460109
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460110
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460112
report
https://bugzilla.redhat.com/show_bug.cgi?id=2463481
report
https://bugzilla.redhat.com/show_bug.cgi?id=2463483
report
https://bugzilla.redhat.com/show_bug.cgi?id=2463484
report
https://bugzilla.redhat.com/show_bug.cgi?id=2463485