CVE-2026-113869
Published:October 20, 2026
Updated:October 29, 2026
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.
Affected Packages
https://github.com/thunderbird/thunderbird-desktop.git (GITHUB):
Affected version(s) >=THUNDERBIRD_153_0b1_BUILD1 <THUNDERBIRD_153_6_0esr_RELEASEFix Suggestion:
Update to version THUNDERBIRD_153_6_0esr_RELEASEhttps://github.com/thunderbird/thunderbird-desktop.git (GITHUB):
Affected version(s) >=THUNDERBIRD_158_0b1_BUILD1 <THUNDERBIRD_158_0_1_RELEASEFix Suggestion:
Update to version THUNDERBIRD_158_0_1_RELEASERelated Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Use After Free
EPSS
Base Score:
0.33