ESB-2026.3766 — Vulnetix

ESB-2026.3766 PUBLISHED CVSS 8.199999809265137 HIGH

=========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2026.3766 thunderbird security update 16 April 2026 =========================================================================== AUSCERT Security Bulletin Summary --------------------------------- Product: thunderbird Publisher: Red Hat Operating System: Red Hat Resolution: Patch/Upgrade CVE Names: CVE-2026-3889 CVE-2026-4371 CVE-2026-4684 CVE-2026-4685 CVE-2026-4686 CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690 CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694 CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698 CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702 CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707 CVE-2026-4708 CVE-2026-4709 CVE-2026-4710 CVE-2026-4711 CVE-2026-4712 CVE-2026-4713 CVE-2026-4714 CVE-2026-4715 CVE-2026-4716 CVE-2026-4717 CVE-2026-4718 CVE-2026-4719 CVE-2026-4720 CVE-2026-4721 Original Bulletin: https://access.redhat.com/errata/RHSA-2026:8315 Comment: CVSS (Max): 8.2 CVE-2026-4371 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) CVSS Source: Red Hat Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H EPSS (Max): 0.1% (17th) CVE-2026-4371 2026-04-15 - --------------------------BEGIN INCLUDED TEXT-------------------- RHSA-2026:8315 - Security Advisory Issued: 2026-04-15 Updated: 2026-04-15 Synopsis Thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): o firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) o firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) o firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) o firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) o firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) o firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) o firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) o firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) o firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) o firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) o firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) o firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) o firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685) o firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714) o firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709) o firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710) o firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712) o firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697) o firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713) o firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690) o firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711) o firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686) o firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708) o firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691) o firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699) o firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696) o firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693) o firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718) o firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702) o firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719) o firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694) o firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692) o firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720) o firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700) o firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707) o firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) o firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687) o thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371) o thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products o Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 o Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x o Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le o Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 o Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 o Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x o Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le o Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes o BZ - 2450710 - CVE-2026-4701 firefox: thunderbird: Use-after-free in the JavaScript Engine component o BZ - 2450711 - CVE-2026-4721 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 o BZ - 2450712 - CVE-2026-4717 firefox: thunderbird: Privilege escalation in the Netmonitor component o BZ - 2450713 - CVE-2026-4688 firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component o BZ - 2450714 - CVE-2026-4706 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component o BZ - 2450715 - CVE-2026-4695 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component o BZ - 2450718 - CVE-2026-4689 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component o BZ - 2450719 - CVE-2026-4698 firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component o BZ - 2450720 - CVE-2026-4716 firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component o BZ - 2450721 - CVE-2026-4684 firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component o BZ - 2450722 - CVE-2026-4705 firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component o BZ - 2450723 - CVE-2026-4715 firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component o BZ - 2450724 - CVE-2026-4685 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component o BZ - 2450725 - CVE-2026-4714 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component o BZ - 2450726 - CVE-2026-4709 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component o BZ - 2450727 - CVE-2026-4710 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component o BZ - 2450728 - CVE-2026-4712 firefox: thunderbird: Information disclosure in the Widget: Cocoa component o BZ - 2450729 - CVE-2026-4697 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component o BZ - 2450730 - CVE-2026-4713 firefox: thunderbird: Incorrect boundary conditions in the Graphics component o BZ - 2450732 - CVE-2026-4690 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component o BZ - 2450733 - CVE-2026-4711 firefox: thunderbird: Use-after-free in the Widget: Cocoa component o BZ - 2450734 - CVE-2026-4686 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component o BZ - 2450735 - CVE-2026-4708 firefox: thunderbird: Incorrect boundary conditions in the Graphics component o BZ - 2450738 - CVE-2026-4691 firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component o BZ - 2450739 - CVE-2026-4699 firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component o BZ - 2450740 - CVE-2026-4696 firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component o BZ - 2450741 - CVE-2026-4693 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component o BZ - 2450742 - CVE-2026-4718 firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component o BZ - 2450744 - CVE-2026-4702 firefox: thunderbird: JIT miscompilation in the JavaScript Engine component o BZ - 2450746 - CVE-2026-4719 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component o BZ - 2450747 - CVE-2026-4694 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component o BZ - 2450748 - CVE-2026-4692 firefox: thunderbird: Sandbox escape in the Responsive Design Mode component o BZ - 2450751 - CVE-2026-4720 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 o BZ - 2450752 - CVE-2026-4700 firefox: thunderbird: Mitigation bypass in the Networking: HTTP component o BZ - 2450755 - CVE-2026-4707 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component o BZ - 2450756 - CVE-2026-4704 firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component o BZ - 2450757 - CVE-2026-4687 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component o BZ - 2451001 - CVE-2026-4371 thunderbird: Out of bounds read in IMAP parsing o BZ - 2451006 - CVE-2026-3889 thunderbird: Spoofing issue in Thunderbird CVEs o CVE-2026-3889 o CVE-2026-4371 o CVE-2026-4684 o CVE-2026-4685 o CVE-2026-4686 o CVE-2026-4687 o CVE-2026-4688 o CVE-2026-4689 o CVE-2026-4690 o CVE-2026-4691 o CVE-2026-4692 o CVE-2026-4693 o CVE-2026-4694 o CVE-2026-4695 o CVE-2026-4696 o CVE-2026-4697 o CVE-2026-4698 o CVE-2026-4699 o CVE-2026-4700 o CVE-2026-4701 o CVE-2026-4702 o CVE-2026-4704 o CVE-2026-4705 o CVE-2026-4706 o CVE-2026-4707 o CVE-2026-4708 o CVE-2026-4709 o CVE-2026-4710 o CVE-2026-4711 o CVE-2026-4712 o CVE-2026-4713 o CVE-2026-4714 o CVE-2026-4715 o CVE-2026-4716 o CVE-2026-4717 o CVE-2026-4718 o CVE-2026-4719 o CVE-2026-4720 o CVE-2026-4721 References o https://access.redhat.com/security/updates/classification/#important - --------------------------END INCLUDED TEXT---------------------- You have received this e-mail bulletin as a result of your organisation's registration with AUSCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AUSCERT's members. As AUSCERT did not write the document quoted above, AUSCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AUSCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://portal.auscert.org.au/bulletins/ =========================================================================== AUSCERT The University of Queensland, Brisbane QLD 4072 Australia e: auscert@auscert.org.au t: +61 (0)7 3365 4417 Allies in Cyber Security ===========================================================================

Risk Scores

CVSS v3.1

8.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected Products

Vendor	Product	Versions
Red Hat	thunderbird

Timeline

Apr 16, 2026 CVE Published
Apr 16, 2026 Distribution Patch

References

Open in Interactive Console →