Vulnerability-Lookup

WID-SEC-W-2026-2458

Vulnerability from csaf_certbund - Published: 2026-07-21 22:00 - Updated: 2026-08-05 22:00

Summary

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Firefox ist ein Open Source Web Browser. ESR ist die Variante mit verlängertem Support.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Berechtigungen zu erweitern, Sandbox-Escapes durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder Speicherbeschädigungen zu verursachen.

Betroffene Betriebssysteme: - Linux - MacOS X - Sonstiges - UNIX - Windows

CVE-2026-14899

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-15718

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-15719

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16349

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16350

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16351

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16352

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16353

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16354

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16355

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16356

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16357

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16358

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16359

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16360

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16361

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16362

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16363

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16364

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16365

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16366

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16367

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16368

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16369

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16370

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16371

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16372

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16373

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16374

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16375

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16376

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16377

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16378

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16379

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16380

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16381

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16382

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16383

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16384

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16385

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16386

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16387

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16388

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16389

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16390

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16391

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16392

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16393

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16394

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16395

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16396

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16397

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16398

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16399

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16400

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16401

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16402

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16403

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16404

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16405

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16406

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16407

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16408

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16409

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16410

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16411

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

CVE-2026-16412

Affected products

Known affected 12 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IGEL OS IGEL	`cpe:/o:igel:os:-`	—
Mozilla Thunderbird <153 Mozilla / Thunderbird		<153
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Mozilla Thunderbird <140.13 Mozilla / Thunderbird		<140.13
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Mozilla Firefox <153 Mozilla / Firefox		<153
Mozilla Firefox ESR <115.38 Mozilla / Firefox ESR		<115.38
Mozilla Firefox ESR <140.13 Mozilla / Firefox ESR		<140.13

References

34 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://security-tracker.debian.org/tracker/DSA-6394-1	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://kb.igel.com/en/security-safety/current/is…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://access.redhat.com/errata/RHSA-2026:47105	external
https://access.redhat.com/errata/RHSA-2026:47101	external
https://linux.oracle.com/errata/ELSA-2026-47105.html	external
https://errata.build.resf.org/RLSA-2026:47105	external
https://security-tracker.debian.org/tracker/DSA-6403-1	external
https://errata.build.resf.org/RLSA-2026:47101	external
https://linux.oracle.com/errata/ELSA-2026-47104.html	external
https://access.redhat.com/errata/RHSA-2026:49621	external
https://access.redhat.com/errata/RHSA-2026:47104	external
https://linux.oracle.com/errata/ELSA-2026-49621.html	external
https://errata.build.resf.org/RLSA-2026:47104	external
https://access.redhat.com/errata/RHSA-2026:49921	external
https://access.redhat.com/errata/RHSA-2026:49922	external
https://linux.oracle.com/errata/ELSA-2026-49922.html	external
http://linux.oracle.com/errata/ELSA-2026-47101.html	external
https://errata.build.resf.org/RLSA-2026:49921	external
https://errata.build.resf.org/RLSA-2026:49621	external
http://linux.oracle.com/errata/ELSA-2026-49921.html	external
https://errata.build.resf.org/RLSA-2026:49922	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Firefox ist ein Open Source Web Browser. \r\nESR ist die Variante mit verl\u00e4ngertem Support.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Berechtigungen zu erweitern, Sandbox-Escapes durchzuf\u00fchren, Daten zu manipulieren, einen Denial-of-Service-Zustand auszul\u00f6sen oder Speicherbesch\u00e4digungen zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2458 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2458.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2458 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2458"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-68 vom 2026-07-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-69 vom 2026-07-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-69/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-70 vom 2026-07-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-71 vom 2026-07-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-71/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-72 vom 2026-07-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-72/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6394 vom 2026-07-23",
        "url": "https://security-tracker.debian.org/tracker/DSA-6394-1"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4695 vom 2026-07-23",
        "url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00037.html"
      },
      {
        "category": "external",
        "summary": "IGEL Security Notice ISN-2026-30 vom 2026-07-22",
        "url": "https://kb.igel.com/en/security-safety/current/isn-2026-30-critical-firefox-esr-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3200-1 vom 2026-07-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027790.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11329-1 vom 2026-07-23",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7Q75SNXKPZN7GI5DJMLO5LBJU6AEAT7M/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3221-1 vom 2026-07-24",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027809.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11359-1 vom 2026-07-26",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJIJRVDFXZ3C64LMZ44SM64EVQVKPYDV/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11358-1 vom 2026-07-26",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BOENUHR7WHRNTPMYNYT37JNSD24XW5JJ/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47105 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:47105"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47101 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:47101"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-47105 vom 2026-07-29",
        "url": "https://linux.oracle.com/errata/ELSA-2026-47105.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:47105 vom 2026-07-29",
        "url": "https://errata.build.resf.org/RLSA-2026:47105"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6403 vom 2026-07-30",
        "url": "https://security-tracker.debian.org/tracker/DSA-6403-1"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:47101 vom 2026-07-30",
        "url": "https://errata.build.resf.org/RLSA-2026:47101"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-47104 vom 2026-07-31",
        "url": "https://linux.oracle.com/errata/ELSA-2026-47104.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49621 vom 2026-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:49621"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47104 vom 2026-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:47104"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-49621 vom 2026-08-04",
        "url": "https://linux.oracle.com/errata/ELSA-2026-49621.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:47104 vom 2026-08-03",
        "url": "https://errata.build.resf.org/RLSA-2026:47104"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49921 vom 2026-08-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:49921"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49922 vom 2026-08-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:49922"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-49922 vom 2026-08-05",
        "url": "https://linux.oracle.com/errata/ELSA-2026-49922.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-47101 vom 2026-08-04",
        "url": "http://linux.oracle.com/errata/ELSA-2026-47101.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:49921 vom 2026-08-06",
        "url": "https://errata.build.resf.org/RLSA-2026:49921"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:49621 vom 2026-08-06",
        "url": "https://errata.build.resf.org/RLSA-2026:49621"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-49921 vom 2026-08-05",
        "url": "http://linux.oracle.com/errata/ELSA-2026-49921.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:49922 vom 2026-08-06",
        "url": "https://errata.build.resf.org/RLSA-2026:49922"
      }
    ],
    "source_lang": "en-US",
    "title": "Mozilla Firefox und Thunderbird: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-05T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-06T08:52:07.558+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2458",
      "initial_release_date": "2026-07-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-22T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Mozilla aufgenommen, Thunderbird ebenfalls betroffen"
        },
        {
          "date": "2026-07-23T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2026-07-26T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2026-07-28T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und Debian aufgenommen"
        },
        {
          "date": "2026-07-30T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-08-02T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-08-03T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-08-04T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2026-08-05T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen"
        }
      ],
      "status": "final",
      "version": "11"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IGEL OS",
            "product": {
              "name": "IGEL OS",
              "product_id": "T017865",
              "product_identification_helper": {
                "cpe": "cpe:/o:igel:os:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IGEL"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c153",
                "product": {
                  "name": "Mozilla Firefox \u003c153",
                  "product_id": "T057025"
                }
              },
              {
                "category": "product_version",
                "name": "153",
                "product": {
                  "name": "Mozilla Firefox 153",
                  "product_id": "T057025-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:firefox:153"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Firefox"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c115.38",
                "product": {
                  "name": "Mozilla Firefox ESR \u003c115.38",
                  "product_id": "T057026"
                }
              },
              {
                "category": "product_version",
                "name": "115.38",
                "product": {
                  "name": "Mozilla Firefox ESR 115.38",
                  "product_id": "T057026-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:firefox_esr:115.38"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c140.13",
                "product": {
                  "name": "Mozilla Firefox ESR \u003c140.13",
                  "product_id": "T057027"
                }
              },
              {
                "category": "product_version",
                "name": "140.13",
                "product": {
                  "name": "Mozilla Firefox ESR 140.13",
                  "product_id": "T057027-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:firefox_esr:140.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Firefox ESR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c153",
                "product": {
                  "name": "Mozilla Thunderbird \u003c153",
                  "product_id": "T057074"
                }
              },
              {
                "category": "product_version",
                "name": "153",
                "product": {
                  "name": "Mozilla Thunderbird 153",
                  "product_id": "T057074-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:thunderbird:153"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c140.13",
                "product": {
                  "name": "Mozilla Thunderbird \u003c140.13",
                  "product_id": "T057075"
                }
              },
              {
                "category": "product_version",
                "name": "140.13",
                "product": {
                  "name": "Mozilla Thunderbird 140.13",
                  "product_id": "T057075-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:thunderbird:140.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Thunderbird"
          }
        ],
        "category": "vendor",
        "name": "Mozilla"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T056236",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T054581",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T054646",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T055946",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14899",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-14899"
    },
    {
      "cve": "CVE-2026-15718",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-15718"
    },
    {
      "cve": "CVE-2026-15719",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-15719"
    },
    {
      "cve": "CVE-2026-16349",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16349"
    },
    {
      "cve": "CVE-2026-16350",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16350"
    },
    {
      "cve": "CVE-2026-16351",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16351"
    },
    {
      "cve": "CVE-2026-16352",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16352"
    },
    {
      "cve": "CVE-2026-16353",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16353"
    },
    {
      "cve": "CVE-2026-16354",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16354"
    },
    {
      "cve": "CVE-2026-16355",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16355"
    },
    {
      "cve": "CVE-2026-16356",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16356"
    },
    {
      "cve": "CVE-2026-16357",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16357"
    },
    {
      "cve": "CVE-2026-16358",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16358"
    },
    {
      "cve": "CVE-2026-16359",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16359"
    },
    {
      "cve": "CVE-2026-16360",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16360"
    },
    {
      "cve": "CVE-2026-16361",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16361"
    },
    {
      "cve": "CVE-2026-16362",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16362"
    },
    {
      "cve": "CVE-2026-16363",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16363"
    },
    {
      "cve": "CVE-2026-16364",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16364"
    },
    {
      "cve": "CVE-2026-16365",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16365"
    },
    {
      "cve": "CVE-2026-16366",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16366"
    },
    {
      "cve": "CVE-2026-16367",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16367"
    },
    {
      "cve": "CVE-2026-16368",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16368"
    },
    {
      "cve": "CVE-2026-16369",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16369"
    },
    {
      "cve": "CVE-2026-16370",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16370"
    },
    {
      "cve": "CVE-2026-16371",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16371"
    },
    {
      "cve": "CVE-2026-16372",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16372"
    },
    {
      "cve": "CVE-2026-16373",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16373"
    },
    {
      "cve": "CVE-2026-16374",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16374"
    },
    {
      "cve": "CVE-2026-16375",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16375"
    },
    {
      "cve": "CVE-2026-16376",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16376"
    },
    {
      "cve": "CVE-2026-16377",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16377"
    },
    {
      "cve": "CVE-2026-16378",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16378"
    },
    {
      "cve": "CVE-2026-16379",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16379"
    },
    {
      "cve": "CVE-2026-16380",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16380"
    },
    {
      "cve": "CVE-2026-16381",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16381"
    },
    {
      "cve": "CVE-2026-16382",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16382"
    },
    {
      "cve": "CVE-2026-16383",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16383"
    },
    {
      "cve": "CVE-2026-16384",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16384"
    },
    {
      "cve": "CVE-2026-16385",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16385"
    },
    {
      "cve": "CVE-2026-16386",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16386"
    },
    {
      "cve": "CVE-2026-16387",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16387"
    },
    {
      "cve": "CVE-2026-16388",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16388"
    },
    {
      "cve": "CVE-2026-16389",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16389"
    },
    {
      "cve": "CVE-2026-16390",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16390"
    },
    {
      "cve": "CVE-2026-16391",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16391"
    },
    {
      "cve": "CVE-2026-16392",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16392"
    },
    {
      "cve": "CVE-2026-16393",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16393"
    },
    {
      "cve": "CVE-2026-16394",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16394"
    },
    {
      "cve": "CVE-2026-16395",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16395"
    },
    {
      "cve": "CVE-2026-16396",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16396"
    },
    {
      "cve": "CVE-2026-16397",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16397"
    },
    {
      "cve": "CVE-2026-16398",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16398"
    },
    {
      "cve": "CVE-2026-16399",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16399"
    },
    {
      "cve": "CVE-2026-16400",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16400"
    },
    {
      "cve": "CVE-2026-16401",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16401"
    },
    {
      "cve": "CVE-2026-16402",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16402"
    },
    {
      "cve": "CVE-2026-16403",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16403"
    },
    {
      "cve": "CVE-2026-16404",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16404"
    },
    {
      "cve": "CVE-2026-16405",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16405"
    },
    {
      "cve": "CVE-2026-16406",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16406"
    },
    {
      "cve": "CVE-2026-16407",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16407"
    },
    {
      "cve": "CVE-2026-16408",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16408"
    },
    {
      "cve": "CVE-2026-16409",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16409"
    },
    {
      "cve": "CVE-2026-16410",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16410"
    },
    {
      "cve": "CVE-2026-16411",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16411"
    },
    {
      "cve": "CVE-2026-16412",
      "product_status": {
        "known_affected": [
          "T056236",
          "2951",
          "T054581",
          "67646",
          "T017865",
          "T057074",
          "T055946",
          "T057075",
          "T054646",
          "T057025",
          "T057026",
          "T057027"
        ]
      },
      "release_date": "2026-07-21T22:00:00.000+00:00",
      "title": "CVE-2026-16412"
    }
  ]
}

CVE-2026-14899 (GCVE-0-2026-14899)

Vulnerability from cvelistv5 – Published: 2026-07-22 19:19 – Updated: 2026-07-27 17:12

Title

Off-by-one out of bounds read in MIME header parser for forwarding

Summary

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-193 - Off-by-one Error

Assigner

mozilla

References

3 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2046137
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

1 product

Vendor	Product	Version
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Claude, Kai Engert

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-14899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:12:35.358996Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-193",
                "description": "CWE-193 Off-by-one Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T17:12:52.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Claude, Kai Engert"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13."
            }
          ],
          "value": "The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:42.305Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2046137"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Off-by-one out of bounds read in MIME header parser for forwarding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-14899",
    "datePublished": "2026-07-22T19:19:42.305Z",
    "dateReserved": "2026-07-06T19:53:12.713Z",
    "dateUpdated": "2026-07-27T17:12:52.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15718 (GCVE-0-2026-15718)

Vulnerability from cvelistv5 – Published: 2026-07-14 12:15 – Updated: 2026-07-22 19:19

Title

Invalid pointer in the JavaScript: WebAssembly component

Summary

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-763 - Release of Invalid Pointer or Reference

Assigner

mozilla

References

4 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2045443
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 152.0.6 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ * (rpm)

Credits

Christian Holler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:34:48.369595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-763",
                "description": "CWE-763 Release of Invalid Pointer or Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T13:35:17.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "152.0.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Christian Holler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13."
            }
          ],
          "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:21.078Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045443"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-67/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Invalid pointer in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-15718",
    "datePublished": "2026-07-14T12:15:46.176Z",
    "dateReserved": "2026-07-14T12:15:45.500Z",
    "dateUpdated": "2026-07-22T19:19:21.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15719 (GCVE-0-2026-15719)

Vulnerability from cvelistv5 – Published: 2026-07-14 12:15 – Updated: 2026-07-22 19:19

Title

Site isolation issue in the DOM: Navigation component

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-noinfo Not enough information

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2043820
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 152.0.6 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ * (rpm)

Credits

Atsushi Sada

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:32:24.747872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T13:33:56.522Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "152.0.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Atsushi Sada"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13."
            }
          ],
          "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:22.168Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2043820"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-67/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Site isolation issue in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-15719",
    "datePublished": "2026-07-14T12:15:47.592Z",
    "dateReserved": "2026-07-14T12:15:46.894Z",
    "dateUpdated": "2026-07-22T19:19:22.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16349 (GCVE-0-2026-16349)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Same-origin policy bypass in the DOM: Navigation component

Summary

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-346 - Origin Validation Error

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2034682
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Tran Quac

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:19:58.133285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:44.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tran Quac"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:14.229Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2034682"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Same-origin policy bypass in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16349",
    "datePublished": "2026-07-21T12:37:31.917Z",
    "dateReserved": "2026-07-20T21:55:46.392Z",
    "dateUpdated": "2026-07-22T19:18:14.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16350 (GCVE-0-2026-16350)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Incorrect boundary conditions in the Audio/Video: cubeb component

Summary

Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2042033
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Tomoya Nakanishi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16350",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:20:58.436609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:34.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tomoya Nakanishi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:15.333Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2042033"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: cubeb component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16350",
    "datePublished": "2026-07-21T12:37:32.759Z",
    "dateReserved": "2026-07-20T21:55:48.638Z",
    "dateUpdated": "2026-07-22T19:18:15.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16351 (GCVE-0-2026-16351)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Sandbox escape due to use-after-free in the DOM: Navigation component

Summary

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2045468
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:21:54.902342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:28.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:17.433Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045468"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16351",
    "datePublished": "2026-07-21T12:37:34.438Z",
    "dateReserved": "2026-07-20T21:55:50.743Z",
    "dateUpdated": "2026-07-22T19:18:17.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16352 (GCVE-0-2026-16352)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Sandbox escape due to use-after-free in the Disability Access APIs component

Summary

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2046416
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16352",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:23:05.783737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:18.943Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:18.625Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2046416"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the Disability Access APIs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16352",
    "datePublished": "2026-07-21T12:37:35.292Z",
    "dateReserved": "2026-07-20T21:55:52.955Z",
    "dateUpdated": "2026-07-22T19:18:18.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16353 (GCVE-0-2026-16353)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Invalid pointer in the DOM: Bindings (WebIDL) component

Summary

Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-824 - Access of Uninitialized Pointer
CWE-416 - Use After Free
CWE-476 - NULL Pointer Dereference

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2049523
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

fedek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16353",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:32:12.984529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "CWE-824 Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:33.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "fedek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:24.106Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049523"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Invalid pointer in the DOM: Bindings (WebIDL) component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16353",
    "datePublished": "2026-07-21T12:37:39.485Z",
    "dateReserved": "2026-07-20T21:55:55.027Z",
    "dateUpdated": "2026-07-22T19:18:24.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16354 (GCVE-0-2026-16354)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Information disclosure in the Graphics: ImageLib component

Summary

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2050626
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

satyamasd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16354",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:33:47.108874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:27.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "satyamasd"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:25.205Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2050626"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Information disclosure in the Graphics: ImageLib component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16354",
    "datePublished": "2026-07-21T12:37:40.337Z",
    "dateReserved": "2026-07-20T21:55:56.965Z",
    "dateUpdated": "2026-07-22T19:18:25.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16355 (GCVE-0-2026-16355)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

JIT miscompilation in the JavaScript Engine: JIT component

Summary

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2052207
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Amy Burnett of OpenAI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:37:59.058129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:04.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Amy Burnett of OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:29.451Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2052207"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "JIT miscompilation in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16355",
    "datePublished": "2026-07-21T12:37:43.741Z",
    "dateReserved": "2026-07-20T21:55:59.129Z",
    "dateUpdated": "2026-07-22T19:18:29.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

WID-SEC-W-2026-2458

CVE-2026-14899 (GCVE-0-2026-14899)

CVE-2026-15718 (GCVE-0-2026-15718)

CVE-2026-15719 (GCVE-0-2026-15719)

CVE-2026-16349 (GCVE-0-2026-16349)

CVE-2026-16350 (GCVE-0-2026-16350)

CVE-2026-16351 (GCVE-0-2026-16351)

CVE-2026-16352 (GCVE-0-2026-16352)

CVE-2026-16353 (GCVE-0-2026-16353)

CVE-2026-16354 (GCVE-0-2026-16354)

CVE-2026-16355 (GCVE-0-2026-16355)

Tags

Sightings

Nomenclature