Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

The version of Thunderbird installed on the remote Windows host is prior to 140.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-72 advisory.

  - Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2026-16360, CVE-2026-16412)

  - The code to parse MIME headers for display when forwarding a message (if the setting to view all headers     was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer     for the headers, and potentially crashing Thunderbird. (CVE-2026-14899)

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. (CVE-2026-15718, CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-72 advisory.

  - Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2026-16360, CVE-2026-16412)

  - The code to parse MIME headers for display when forwarding a message (if the setting to view all headers     was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer     for the headers, and potentially crashing Thunderbird. (CVE-2026-14899)

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. (CVE-2026-15718, CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6394 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6394-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 22, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2026-15718 CVE-2026-15719 CVE-2026-16349 CVE-2026-16350                      CVE-2026-16351 CVE-2026-16352 CVE-2026-16353 CVE-2026-16354                      CVE-2026-16355 CVE-2026-16356 CVE-2026-16357 CVE-2026-16358                      CVE-2026-16359 CVE-2026-16360 CVE-2026-16361 CVE-2026-16362                      CVE-2026-16363 CVE-2026-16368 CVE-2026-16369 CVE-2026-16371                      CVE-2026-16374 CVE-2026-16375 CVE-2026-16377 CVE-2026-16379                      CVE-2026-16381 CVE-2026-16383 CVE-2026-16387 CVE-2026-16390                      CVE-2026-16391 CVE-2026-16396 CVE-2026-16405 CVE-2026-16412

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code, bypass of the same-origin policy, privilege escalation,     information disclosure, spoofing or sandbox escape.

    For the stable distribution (trixie), these problems have been fixed in     version 140.13.0esr-1~deb13u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4695 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4695-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     July 22, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : firefox-esr     Version        : 140.13.0esr-1~deb11u1 140.13.0esr-1~deb12u1     CVE ID         : CVE-2026-15718 CVE-2026-15719 CVE-2026-16349 CVE-2026-16350                      CVE-2026-16351 CVE-2026-16352 CVE-2026-16353 CVE-2026-16354                      CVE-2026-16355 CVE-2026-16356 CVE-2026-16357 CVE-2026-16358                      CVE-2026-16359 CVE-2026-16360 CVE-2026-16361 CVE-2026-16362                      CVE-2026-16363 CVE-2026-16368 CVE-2026-16369 CVE-2026-16371                      CVE-2026-16374 CVE-2026-16375 CVE-2026-16377 CVE-2026-16379                      CVE-2026-16381 CVE-2026-16383 CVE-2026-16387 CVE-2026-16390                      CVE-2026-16391 CVE-2026-16396 CVE-2026-16405 CVE-2026-16412

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code, bypass of the same-origin policy, privilege escalation,     information disclosure, spoofing or sandbox escape.

    For Debian 11 bullseye, these problems have been fixed in version     140.13.0esr-1~deb11u1.

    For Debian 12 bookworm, these problems have been fixed in version     140.13.0esr-1~deb12u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.38. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-69 advisory.

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. (CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16349)

  - Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in     Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16351)

  - Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16353)

  - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.38. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-69 advisory.

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. (CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16349)

  - Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in     Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16351)

  - Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16353)

  - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13. (CVE-2026-16355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-70 advisory.

  - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-16412)

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. (CVE-2026-15718, CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

  - Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox     ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 140.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-70 advisory.

  - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-16412)

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. (CVE-2026-15718, CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

  - Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox     ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
329091	Mozilla Thunderbird < 140.13	Nessus	Windows	critical
329089	Mozilla Thunderbird < 140.13	Nessus	MacOS X Local Security Checks	critical
329076	Debian dsa-6394 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
329074	Debian dla-4695 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
328776	Mozilla Firefox ESR < 115.38	Nessus	Windows	critical
328775	Mozilla Firefox ESR < 115.38	Nessus	MacOS X Local Security Checks	critical
328772	Mozilla Firefox ESR < 140.13	Nessus	MacOS X Local Security Checks	critical
328771	Mozilla Firefox ESR < 140.13	Nessus	Windows	critical

Detections

Analytics

CVE-2026-16361

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical