PT-2026-92474 · Mozilla+1 · Thunderbird+1
CVE-2026-92238
·
Published
2026-09-15
·
Updated
2026-09-30
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 140.16
Thunderbird versions prior to 153.3
Thunderbird versions prior to 156
Description
A maliciously constructed mail header can cause multiple fields to be parsed as a single field or lead to memory safety violations, which occur when a program improperly handles memory access, potentially causing crashes or unauthorized code execution.
Recommendations
Update to version 140.16 or later.
Update to version 153.3 or later.
Update to version 156 or later.
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rocky Linux
Thunderbird