PatchFirst · Latest vulnerabilities

thunderbird vulnerabilities · Page 12

Vulnerabilities published for thunderbird in the last 30 days: 107. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1152

CVE-2026-12328
High · CVSS 8.1EPSS 0.48%Fix available
Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12327
High · CVSS 8.1EPSS 0.41%Fix available
Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 17, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12325
Medium · CVSS 6.5EPSS 0.23%Fix available
Denial-of-service in the Graphics: ImageLib component
Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12324
High · CVSS 7.3EPSS 0.21%Fix available
Incorrect boundary conditions in the Graphics: CanvasWebGL component
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12315
Critical · CVSS 9.1EPSS 0.25%Fix available
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12314
High · CVSS 7.5EPSS 0.25%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12313
Medium · CVSS 4.7EPSS 0.18%Fix available
Information disclosure, sandbox escape in the Security: Process Sandboxing component
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12312
High · CVSS 7.5EPSS 0.25%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12311
Medium · CVSS 4.7EPSS 0.18%Fix available
Information disclosure, sandbox escape in the Security: Process Sandboxing component
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12310
High · CVSS 7.5EPSS 0.25%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12309
Medium · CVSS 6.5EPSS 0.24%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12308
Medium · CVSS 5.3EPSS 0.26%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12307
Medium · CVSS 5.3EPSS 0.26%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12306
Medium · CVSS 5.3EPSS 0.26%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12305
High · CVSS 7.5EPSS 0.37%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12304
Critical · CVSS 9.1EPSS 0.19%Fix available
Same-origin policy bypass in the Networking: Cookies component
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12302
Medium · CVSS 6.5EPSS 0.25%Fix available
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated June 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12299
Medium · CVSS 5.4EPSS 0.31%Fix available
JIT miscompilation in the DOM: Core & HTML component
JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12298
Medium · CVSS 5.4EPSS 0.31%Fix available
Memory safety bug fixed in Thunderbird 152
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated October 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-12297
Critical · CVSS 9.6EPSS 0.39%Fix available
Sandbox escape due to incorrect boundary conditions in the Networking component
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
thunderbird Operating systems
- Update to 1:140.12.0esr-1~deb13u1
Published June 16, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

thunderbird vulnerabilities · Page 12

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Denial-of-service in the Graphics: ImageLib component

Incorrect boundary conditions in the Graphics: CanvasWebGL component

Mitigation bypass in the DOM: Security component

Memory safety bug fixed in Thunderbird 152

Information disclosure, sandbox escape in the Security: Process Sandboxing component

Memory safety bug fixed in Thunderbird 152

Information disclosure, sandbox escape in the Security: Process Sandboxing component

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152

Same-origin policy bypass in the Networking: Cookies component

Mitigation bypass in the DOM: Security component

JIT miscompilation in the DOM: Core & HTML component

Memory safety bug fixed in Thunderbird 152

Sandbox escape due to incorrect boundary conditions in the Networking component

Check your server