CVE-2026-113867

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.5.1 Thunderbird versions prior to 158.0.1

Description Thunderbird fails to escape attribute values when serializing outgoing XMPP stanzas. Since values from incoming requests are echoed back in automatic replies, a remote XMPP user can send a crafted request to inject arbitrary stanzas into the user's connection. The server then processes these stanzas as if they were sent by the user, allowing the attacker to send messages or modify contact and subscription settings without user interaction. This issue specifically affects the chat feature used with XMPP accounts.

Recommendations Update to version 153.5.1. Update to version 158.0.1.