Vulnpedia
← Search CVEs

CVE-2026-113869

MEDIUM 5.4

Published 2026-10-20 · Last modified 2026-10-20

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 20th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

5.4CVSS 3.1 · MEDIUM

  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Mozilla

Products Thunderbird

Weakness (CWE)

  • CWE-416: Use After Free

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References and research data (JSON)

Vendor product assessments

  • thunderbird as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent premature deallocation of the S/MIME message decoder when message loading completes or is canceled while an interactive password prompt is open: upgrade to Thunderbird 158.0.1 (or the fixed Thunderbird builds), which prevents freeing the message decoder while it remains in use during active S/MIME security device password prompts, closing S/MIME encrypted message delivery triggering an interactive password prompt. Until patched, this is a concern on Thunderbird installations opening S/MIME encrypted messages across all supported platforms, so exercise caution when opening untrusted S/MIME messages and avoid canceling message load operations while smartcard PIN or Primary Password prompt dialogs are displayed. As a compensating measure, maintain Address Space Layout Randomization to randomize Thunderbird process memory and impede gadget predictability, deploy Endpoint Detection and Response agents to detect behavioral anomalies and post-exploitation activity, and enforce Non-Executable Memory (NX/XD bit) protections to block code execution from corrupted heap and data pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
    • none available: Affected
    Red Hat · CVE-2026-113869 · Updated 2026-10-20T21:31:08+00:00
  • thunderbird.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent premature deallocation of the S/MIME message decoder when message loading completes or is canceled while an interactive password prompt is open: upgrade to Thunderbird 158.0.1 (or the fixed Thunderbird builds), which prevents freeing the message decoder while it remains in use during active S/MIME security device password prompts, closing S/MIME encrypted message delivery triggering an interactive password prompt. Until patched, this is a concern on Thunderbird installations opening S/MIME encrypted messages across all supported platforms, so exercise caution when opening untrusted S/MIME messages and avoid canceling message load operations while smartcard PIN or Primary Password prompt dialogs are displayed. As a compensating measure, maintain Address Space Layout Randomization to randomize Thunderbird process memory and impede gadget predictability, deploy Endpoint Detection and Response agents to detect behavioral anomalies and post-exploitation activity, and enforce Non-Executable Memory (NX/XD bit) protections to block code execution from corrupted heap and data pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
    • none available: Affected
    Red Hat · CVE-2026-113869 · Updated 2026-10-20T21:31:08+00:00
  • thunderbird as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent premature deallocation of the S/MIME message decoder when message loading completes or is canceled while an interactive password prompt is open: upgrade to Thunderbird 158.0.1 (or the fixed Thunderbird builds), which prevents freeing the message decoder while it remains in use during active S/MIME security device password prompts, closing S/MIME encrypted message delivery triggering an interactive password prompt. Until patched, this is a concern on Thunderbird installations opening S/MIME encrypted messages across all supported platforms, so exercise caution when opening untrusted S/MIME messages and avoid canceling message load operations while smartcard PIN or Primary Password prompt dialogs are displayed. As a compensating measure, maintain Address Space Layout Randomization to randomize Thunderbird process memory and impede gadget predictability, deploy Endpoint Detection and Response agents to detect behavioral anomalies and post-exploitation activity, and enforce Non-Executable Memory (NX/XD bit) protections to block code execution from corrupted heap and data pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
    • none available: Affected
    Red Hat · CVE-2026-113869 · Updated 2026-10-20T21:31:08+00:00
  • thunderbird.src as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent premature deallocation of the S/MIME message decoder when message loading completes or is canceled while an interactive password prompt is open: upgrade to Thunderbird 158.0.1 (or the fixed Thunderbird builds), which prevents freeing the message decoder while it remains in use during active S/MIME security device password prompts, closing S/MIME encrypted message delivery triggering an interactive password prompt. Until patched, this is a concern on Thunderbird installations opening S/MIME encrypted messages across all supported platforms, so exercise caution when opening untrusted S/MIME messages and avoid canceling message load operations while smartcard PIN or Primary Password prompt dialogs are displayed. As a compensating measure, maintain Address Space Layout Randomization to randomize Thunderbird process memory and impede gadget predictability, deploy Endpoint Detection and Response agents to detect behavioral anomalies and post-exploitation activity, and enforce Non-Executable Memory (NX/XD bit) protections to block code execution from corrupted heap and data pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
    • none available: Affected
    Red Hat · CVE-2026-113869 · Updated 2026-10-20T21:31:08+00:00
  • thunderbird as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent premature deallocation of the S/MIME message decoder when message loading completes or is canceled while an interactive password prompt is open: upgrade to Thunderbird 158.0.1 (or the fixed Thunderbird builds), which prevents freeing the message decoder while it remains in use during active S/MIME security device password prompts, closing S/MIME encrypted message delivery triggering an interactive password prompt. Until patched, this is a concern on Thunderbird installations opening S/MIME encrypted messages across all supported platforms, so exercise caution when opening untrusted S/MIME messages and avoid canceling message load operations while smartcard PIN or Primary Password prompt dialogs are displayed. As a compensating measure, maintain Address Space Layout Randomization to randomize Thunderbird process memory and impede gadget predictability, deploy Endpoint Detection and Response agents to detect behavioral anomalies and post-exploitation activity, and enforce Non-Executable Memory (NX/XD bit) protections to block code execution from corrupted heap and data pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
    • none available: Affected
    Red Hat · CVE-2026-113869 · Updated 2026-10-20T21:31:08+00:00
  • thunderbird.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent premature deallocation of the S/MIME message decoder when message loading completes or is canceled while an interactive password prompt is open: upgrade to Thunderbird 158.0.1 (or the fixed Thunderbird builds), which prevents freeing the message decoder while it remains in use during active S/MIME security device password prompts, closing S/MIME encrypted message delivery triggering an interactive password prompt. Until patched, this is a concern on Thunderbird installations opening S/MIME encrypted messages across all supported platforms, so exercise caution when opening untrusted S/MIME messages and avoid canceling message load operations while smartcard PIN or Primary Password prompt dialogs are displayed. As a compensating measure, maintain Address Space Layout Randomization to randomize Thunderbird process memory and impede gadget predictability, deploy Endpoint Detection and Response agents to detect behavioral anomalies and post-exploitation activity, and enforce Non-Executable Memory (NX/XD bit) protections to block code execution from corrupted heap and data pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
    • none available: Affected
    Red Hat · CVE-2026-113869 · Updated 2026-10-20T21:31:08+00:00

All CVSS metrics

  • MEDIUM 5.4 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
  • MEDIUM 5.4 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS