Description
Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Published: 2026-05-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Patch
AI Analysis

Impact

The vulnerabilities in Thunderbird 140.10 and Thunderbird 150 involve memory corruption bugs that could be exploited to run arbitrary code if sufficient effort is applied. These bugs are classic memory safety violations, including out‑of‑bounds writes (CWE‑787) and buffer over‑reads (CWE‑119). A successful exploitation would give attackers full control of the Thunderbird process, compromising the confidentiality, integrity, and availability of user data and system resources.

Affected Systems

Mozilla Thunderbird with releases 140.10 and 150 are affected, fixed by Thunderbird 140.11 and 151. Mozilla Firefox is also mentioned; the patch was applied in Firefox 151 and Firefox ESR 140.11. No other versions are listed as affected.

Risk and Exploitability

Concrete exploitation details are not disclosed, the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Because the bugs are classic memory corruption that could lead to arbitrary code execution, the CVSS score of 8.8 indicates a high severity. Based on the description, it is inferred that the attack vector could involve malicious email attachments or HTML content processed by Thunderbird, triggering the memory corruption.

Generated by OpenCVE AI on October 23, 2026 at 01:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Thunderbird to the latest patched release (140.11 or 151).
  • Upgrade Firefox to the latest patched release (151 or ESR 140.11).
  • Restart Firefox and Thunderbird (or reboot) to load the updated memory safety libraries.

Generated by OpenCVE AI on October 23, 2026 at 01:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4592-1 firefox-esr security update
Debian DLA Debian DLA DLA-4594-1 thunderbird security update
Debian DSA Debian DSA DSA-6283-1 firefox-esr security update
Debian DSA Debian DSA DSA-6288-1 thunderbird security update
History

Wed, 21 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Title Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

Tue, 26 May 2026 18:00:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Title Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151

Fri, 22 May 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 21 May 2026 09:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 20 May 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla thunderbird

Tue, 19 May 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-754
CWE-787

Tue, 19 May 2026 17:45:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11. Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Title Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
References

Tue, 19 May 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-754
CWE-787
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 19 May 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 19 May 2026 13:45:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.
Title Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-21T13:50:45.616Z

Reserved: 2026-05-19T12:30:22.393Z

Link: CVE-2026-8974

cve-icon Vulnrichment

Updated: 2026-05-19T15:13:10.454Z

cve-icon NVD

Status : Modified

Published: 2026-05-19T14:16:53.977

Modified: 2026-10-21T14:17:21.553

Link: CVE-2026-8974

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-05-19T12:30:23Z

Links: CVE-2026-8974 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T01:15:14Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write