Description
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Memory safety bugs were discovered in Mozilla Thunderbird ESR 140.12, causing memory corruption. The bugs could allow an attacker to execute arbitrary code if sufficient effort is applied to trigger the corruption. The issue is classified as a buffer over-read/write (CWE-119).

Affected Systems

The vulnerability affects Mozilla Thunderbird running version 140.12. The same bugs also appear in Mozilla Firefox ESR 115.38 and 140.13, but the original discovery was specific to Thunderbird. Upgrading to Thunderbird 140.13 or newer, or to Firefox ESR 115.38 or newer, removes the flaw.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. The EPSS score of < 1% suggests that automated exploitation attempts are unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Because the bugs involve memory corruption, the potential for arbitrary code execution exists, but the exact exploitation conditions are not detailed in the advisory; it is presumed that a malicious payload would be required.

Generated by OpenCVE AI on August 5, 2026 at 02:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mozilla Thunderbird to version 140.13 or newer.
  • Upgrade Mozilla Firefox ESR to version 115.38 or newer.
  • If an update is not immediately possible, consider uninstalling Thunderbird until the patch is available.

Generated by OpenCVE AI on August 5, 2026 at 02:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4695-1 firefox-esr security update
Debian DLA Debian DLA DLA-4727-1 thunderbird security update
Debian DSA Debian DSA DSA-6394-1 firefox-esr security update
Debian DSA Debian DSA DSA-6418-1 thunderbird security update
History

Fri, 24 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 115.37 and Firefox ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38 and Firefox ESR 140.13. Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
Title Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 Memory safety bugs fixed in Thunderbird ESR 140.13
References

Tue, 21 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 115.37 and Firefox ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38 and Firefox ESR 140.13.
Title Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-24T03:55:36.035Z

Reserved: 2026-07-20T21:56:10.203Z

Link: CVE-2026-16361

cve-icon Vulnrichment

Updated: 2026-07-21T18:56:01.630Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-21T12:38:27Z

Links: CVE-2026-16361 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:15:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer