CVE-2026-92238

9.8 criticalEPSS 0.5%

Critical (9.8) in mozilla thunderbird. EPSS 0.5% chance of exploitation in the next 30 days.

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-11-01)
CWE: CWE-444
Published: 2026-09-15
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

Affected

mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2060601
https://www.mozilla.org/security/advisories/mfsa2026-94/
https://www.mozilla.org/security/advisories/mfsa2026-95/
https://www.mozilla.org/security/advisories/mfsa2026-96/

Check your stack JSON