CVE-2026-113869

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 158.0.1

Description A use-after-free issue occurs during the decryption of an S/MIME message when the application prompts for a security device password, such as a smartcard PIN or the Primary Password. If the message load process finishes or is cancelled while the prompt remains open, the message decoder is freed while still in use, which can lead to a crash.

Recommendations Update to version 158.0.1.