CVE-2026-113869 Mozilla CVE debrief

Who should care

Defenders responsible for managing Thunderbird installations, particularly those using S/MIME encryption, should assess exposure and prioritize patching. They should also review inventory of Thunderbird installations and monitor for potential crashes when decrypting S/MIME messages.

Why it matters

A use-after-free vulnerability in Thunderbird could lead to a potentially exploitable crash when decrypting S/MIME messages. Defenders should prioritize verifying and applying patches for Thunderbird versions prior to 158.0.1 and 153.6, monitor for potential crashes, and review inventory of Thunderbird installations.

• Potential crashes when decrypting S/MIME messages
• Need to verify and apply patches for Thunderbird versions prior to 158.0.1 and 153.6
• Importance of monitoring for potential security issues in Thunderbird

Technical summary

When Thunderbird asked for a security device password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. The vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6. Defenders should prioritize verifying and applying patches for Thunderbird versions prior to 158.0.1 and 153.6 and monitor for potential security issues in Thunderbird.

Defensive priority

Defenders should prioritize verifying and applying patches for Thunderbird versions prior to 158.0.1 and 153.6.

Recommended defensive actions

• Verify and apply patches for Thunderbird versions prior to 158.0.1 and 153.6
• Monitor for potential crashes when decrypting S/MIME messages
• Review and update inventory of Thunderbird installations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6. The NVD entry is currently Awaiting Analysis. Defenders should verify patches for Thunderbird versions prior to 158.0.1 and 153.6 and monitor for potential crashes when decrypting S/MIME messages. Limited source detail is provided; explicit evidence limits apply. Defensive verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.