CVE-2026-113867 Mozilla CVE debrief

Who should care

Thunderbird users with XMPP accounts, security teams monitoring XMPP usage, and operators managing Thunderbird deployments. These stakeholders should assess exposure and prioritize verification of chat feature usage due to potential unauthorized actions by remote XMPP users.

Why it matters

CVE-2026-113867 allows remote XMPP users to inject arbitrary stanzas into Thunderbird user's connections, potentially leading to unauthorized actions. Defenders should prioritize verifying XMPP chat feature usage and ensuring users are on updated versions.

• Potential unauthorized message sending on behalf of the user
• Possible changes to contact and subscription settings without user interaction
• Requires verification of XMPP chat feature usage and user account security
• Necessitates ensuring users are on updated Thunderbird versions

Technical summary

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas, allowing remote XMPP users to inject arbitrary stanzas into the user's connection. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. The vulnerability affects Thunderbird's chat feature with XMPP accounts and was fixed in Thunderbird 158.0.1 and 153.5.1. Defenders should prioritize verifying XMPP chat feature usage and ensuring users are on updated versions.

Defensive priority

Defenders should prioritize verifying XMPP chat feature usage and ensuring users are on updated versions.

Recommended defensive actions

• Verify XMPP chat feature usage in Thunderbird
• Ensure users are on Thunderbird 158.0.1 or 153.5.1
• Monitor for suspicious XMPP activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. Defenders should verify XMPP chat feature usage and ensure users are on updated versions. Evidence limits suggest focusing on Thunderbird's chat feature with XMPP accounts. Verification tasks include reviewing XMPP chat logs and user account security.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.