CVE-2026-16360 - Vulnerability Details

- Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153

Description

Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Published: 2026-07-21

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Memory safety bugs were discovered in Thunderbird ESR 140.12 and Thunderbird 152. The bugs exhibit memory corruption and, with sufficient effort, could be leveraged to execute arbitrary code. These vulnerabilities are fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Affected Systems

The vulnerability affects Mozilla Thunderbird. Versions prior to the patched releases—Thunderbird ESR 140.12 and Thunderbird 152—are susceptible. The same set of bugs also existed in earlier Thunderbird releases before 140.13 and 153. The fixes are included in Thunderbird 153 and Thunderbird ESR 140.13.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity, yet the EPSS score of less than 1% demonstrates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, meaning no known active exploits are reported. Based on the description, it is inferred that the most likely attack vectors involve exposure to maliciously crafted email attachments that, when processed by Thunderbird, trigger the memory corruption. User interaction such as opening an email is typically required for exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.38`	unaffected	≤ 115.*
`140.13`	unaffected	≤ 140.*
`153`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.13`	unaffected	≤ 140.*
`153`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[115.38,115.*]`	unaffected	generic	—
`[140.13,140.*]`	unaffected	generic	—
`[153,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Thunderbird ESR 140.13 or Thunderbird 153 updates from Mozilla’s official site.
If an immediate upgrade cannot be performed, uninstall or disable all unpatched Thunderbird installations to remove the vulnerable attack surface.
As a temporary measure, review email filtering settings to restrict or quarantine attachments that could trigger the bug and consider disabling scripting in the Thunderbird email client until a patch is applied.

Generated by OpenCVE AI on October 23, 2026 at 00:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4695-1	firefox-esr security update
Debian DLA	DLA-4727-1	thunderbird security update
Debian DSA	DSA-6394-1	firefox-esr security update
Debian DSA	DSA-6418-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00609.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043739%2C2045281%2C2045614%2C2045744%2C2045775%2C2047719%2C2049805%2C2051666
https://nvd.nist.gov/vuln/detail/CVE-2026-16360
https://www.cve.org/CVERecord?id=CVE-2026-16360
https://www.mozilla.org/security/advisories/mfsa2026-68/
https://www.mozilla.org/security/advisories/mfsa2026-69/
https://www.mozilla.org/security/advisories/mfsa2026-70/
https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360
https://www.mozilla.org/security/advisories/mfsa2026-71/
https://www.mozilla.org/security/advisories/mfsa2026-72/
https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360

History

Wed, 21 Oct 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.	Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Title	Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153	Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153

Fri, 24 Jul 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2026-16360 https://www.cve.org/CVERecord?id=CVE-2026-16360 https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360 https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360
Metrics	threat_severity `None`	threat_severity `Important`

Thu, 23 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.	Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Title	Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153	Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

Wed, 22 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description	Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.	Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Title	Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153	Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
References		https://www.mozilla.org/security/advisories/mfsa2026-71/ https://www.mozilla.org/security/advisories/mfsa2026-72/

Wed, 22 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 22 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 21 Jul 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
Title		Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
References		https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587 https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043739%2C2045281%2C2045614%2C2045744%2C2045775%2C2047719%2C2049805%2C2051666 https://www.mozilla.org/security/advisories/mfsa2026-68/ https://www.mozilla.org/security/advisories/mfsa2026-69/ https://www.mozilla.org/security/advisories/mfsa2026-70/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-07-21T12:38:24.293Z

Updated: 2026-10-21T13:49:57.831Z

Reserved: 2026-07-20T21:56:09.806Z

Link: CVE-2026-16360

Vulnrichment

Updated: 2026-07-22T15:45:26.080Z

NVD

Status : Modified

Published: 2026-07-21T13:17:04.517

Modified: 2026-10-24T20:10:00.137

Link: CVE-2026-16360

Redhat

Severity : Important

Publid Date: 2026-07-21T12:38:24Z

Links: CVE-2026-16360 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:45:13Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object