Critical severity9.8NVD Advisory· Published Sep 15, 2026· Updated Sep 24, 2026
CVE-2026-92238
CVE-2026-92238
Description
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <140.16.0
- (no CPE)range: before 156, 140.x before 140.16, 153.x before 153.3
- osv-coords2 versions
< 140.16.0-1.el9_8.alma.1+ 1 more
- (no CPE)range: < 140.16.0-1.el9_8.alma.1
- (no CPE)range: < 140.16.0-1.1
Patches
Vulnerability mechanics
References
4- www.mozilla.org/security/advisories/mfsa2026-94/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-95/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-96/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
0No linked articles in our index yet.