CVE-2026-8975

Vulnerability

CVE-2026-8975 is a collection of memory safety bugs present in Thunderbird versions 140.10 and 150. These bugs showed evidence of memory corruption, and Mozilla presumes that with enough effort some of them could have been exploited to run arbitrary code. The vulnerability also affected Firefox 140.10 and Firefox 150. Affected versions include Thunderbird 140.10 and Thunderbird 150. [1][2][3]

Exploitation

In the Thunderbird product, these flaws cannot be exploited through email because scripting is disabled when reading mail. However, they are potentially exploitable in browser or browser-like contexts where scripting is enabled. No further details on the specific attack vector or required conditions have been provided in the available references. [2][3]

Impact

Successful exploitation could allow an attacker to achieve arbitrary code execution, leading to full compromise of the affected system. The impact is rated as high by Mozilla. [1][2]

Mitigation

The vulnerability was fixed in Thunderbird 151 and Thunderbird 140.11, released on May 19, 2026. Users should update to these versions or later. Mozilla also fixed the issue in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. [1][2][3][4]