Mozilla Thunderbird: Eight Vulnerabilities Patched, Including eMudhra CA Key Compromise
Key findings • Eight vulnerabilities in Mozilla Thunderbird patched on October 20, 2026, fixed in version 158.0.1. • A critical eMudhra CA key compromise (CVE-2026-113470) was addressed via O…
Key findings
- Eight vulnerabilities in Mozilla Thunderbird patched on October 20, 2026, fixed in version 158.0.1.
- A critical eMudhra CA key compromise (CVE-2026-113470) was addressed via OneCRL block list updates.
- Vulnerabilities include use-after-free (CVE-2026-113869), memory disclosure (CVE-2026-113868), and DoS in PDF viewer (CVE-2026-113401).
- XMPP stanza injection (CVE-2026-113867) and credential exposure via Exchange AutoDiscover (CVE-2026-113866) were also patched.
- Issues related to SVG (CVE-2026-113399) and Audio/Video components (CVE-2026-113400) were also disclosed.
On October 20, 2026, Mozilla Corporation addressed eight vulnerabilities in its Thunderbird email client, with disclosures spanning a 7-hour window. The batch includes a mix of security issues, with a notable focus on certificate handling and memory corruption vulnerabilities. The vulnerabilities were patched in Thunderbird 158.0.1.
One of the most significant disclosures, CVE-2026-113470, relates to a compromise of eight eMudhra intermediate certificate authority (CA) keys. Mozilla blocked these compromised certificates via OneCRL on October 17, 2026, and distributed the updated block list to clients the same day. This ensures that Thunderbird will block these compromised certificates even if RemoteSettings is disabled. This issue was also covered by The Hacker News, highlighting the potential for attackers to issue fraudulent certificates.
Several vulnerabilities stem from memory safety issues. CVE-2026-113869 describes a use-after-free vulnerability that could occur when decrypting S/MIME messages, potentially leading to a crash or arbitrary code execution. CVE-2026-113868 involves a flaw in NTLM authentication where uninitialized heap memory could be disclosed to a malicious server due to an invalid base64 challenge. Additionally, CVE-2026-113400 points to uninitialized memory in the Audio/Video component, and CVE-2026-113399 details incorrect boundary conditions in the SVG component.
Other vulnerabilities include a denial-of-service flaw in the PDF Viewer component (CVE-2026-113401) and an XMPP stanza injection vulnerability (CVE-2026-113867) where Thunderbird failed to escape attribute values, allowing a remote attacker to inject arbitrary stanzas. A separate issue, CVE-2026-113866, involved Thunderbird's Exchange AutoDiscover service querying over plain HTTP, inadvertently exposing user credentials to network attackers.
All eight vulnerabilities were fixed in Thunderbird 158.0.1. Users are strongly advised to update to the latest version to protect themselves from these security risks. The coordinated disclosure of these vulnerabilities highlights the ongoing efforts to secure email communication and associated protocols.