Use-After-Free Vulnerability in Thunderbird by Mozilla
CVE-2026-113869

5.4MEDIUM

Key Information:

Vendor

Mozilla
Status
Thunderbird
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113869?

A vulnerability exists in Thunderbird, where a security device password prompt appearing during the decryption of S/MIME messages could be mismanaged. If the decryption request completes or is canceled while this prompt is active, it leads to a use-after-free scenario. This flaw can cause the message decoder to be released prematurely, which may result in application crashes and potential exploits by attackers. Users are advised to update to Thunderbird version 158.0.1 to mitigate this issue.

Affected Version(s)

Thunderbird 158.0.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2075530
https://www.mozilla.org/security/advisories/mfsa2026-114/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stefan Tatschner
.