CVE-2026-84142

CriticalCVSS 9.8/10Last modified Sep 3, 2026

Description

Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029421%2C2040889%2C2045313%2C2045435%2C2053578%2C2058621%2C2058626Issue Tracking
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2048796%2C2053150%2C2057356Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2026-82/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-86/Vendor Advisory

Timeline

Published: Sep 1, 2026
Last modified: Sep 3, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-841439.8Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of me CVE-2026-841447.5Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or anoth CVE-2026-841457.5Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of me CVE-2026-841465.3The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rende CVE-2026-8414710.0This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint.CVE-2026-841489.2This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticate CVE-2026-841499.2This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unaut CVE-2026-84158.8Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. T CVE-2026-841505.4The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user CVE-2026-841513.5The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it CVE-2026-841536.3A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=CVE-2026-841549.9A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x