Remote Code Injection in Thunderbird's XMPP Chat Feature by Mozilla

CVE-2026-113867

What is CVE-2026-113867?

The vulnerability in Thunderbird's chat functionality allowed unsanitized attribute values from incoming XMPP requests to be processed in automatic replies. This issue enabled a remote XMPP user to execute crafted requests that could inject arbitrary stanzas into the user's connection, facilitating unauthorized actions like sending messages or altering subscription settings without user interaction. The issue was only present in the chat feature with XMPP accounts and has been addressed in the latest releases.

References