An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4727 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4727-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     August 10, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:140.13.0esr-2~deb11u1 1:140.13.0esr-2~deb12u1     CVE ID         : CVE-2026-14899 CVE-2026-15718 CVE-2026-15719 CVE-2026-16349                      CVE-2026-16350 CVE-2026-16351 CVE-2026-16352 CVE-2026-16353                      CVE-2026-16354 CVE-2026-16355 CVE-2026-16356 CVE-2026-16357                      CVE-2026-16358 CVE-2026-16359 CVE-2026-16360 CVE-2026-16361                      CVE-2026-16362 CVE-2026-16363 CVE-2026-16368 CVE-2026-16369                      CVE-2026-16371 CVE-2026-16374 CVE-2026-16375 CVE-2026-16377                      CVE-2026-16379 CVE-2026-16381 CVE-2026-16383 CVE-2026-16387                      CVE-2026-16390 CVE-2026-16391 CVE-2026-16396 CVE-2026-16405                      CVE-2026-16412 CVE-2026-57962 CVE-2026-57963

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1:140.13.0esr-2~deb11u1.

    For Debian 12 bookworm, these problems have been fixed in version     1:140.13.0esr-2~deb12u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6418 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6418-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 07, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : thunderbird     CVE ID         : CVE-2026-14899 CVE-2026-15718 CVE-2026-15719 CVE-2026-16349                      CVE-2026-16350 CVE-2026-16351 CVE-2026-16352 CVE-2026-16353                      CVE-2026-16354 CVE-2026-16355 CVE-2026-16356 CVE-2026-16357                      CVE-2026-16358 CVE-2026-16359 CVE-2026-16360 CVE-2026-16361                      CVE-2026-16362 CVE-2026-16363 CVE-2026-16368 CVE-2026-16369                      CVE-2026-16371 CVE-2026-16374 CVE-2026-16375 CVE-2026-16377                      CVE-2026-16379 CVE-2026-16381 CVE-2026-16383 CVE-2026-16387                      CVE-2026-16390 CVE-2026-16391 CVE-2026-16396 CVE-2026-16405                      CVE-2026-16412 CVE-2026-57962 CVE-2026-57963

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 1:140.13.0esr-2~deb13u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content,     phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1     and Thunderbird 140.12.1. (CVE-2026-57963)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-64 advisory.

  - An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content,     phishing links, and CSS that manipulates the chat UI. (CVE-2026-57963)

  - A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete,     can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it     crashes due to memory exhaustion. (CVE-2026-57962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 152.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-63 advisory.

  - An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content,     phishing links, and CSS that manipulates the chat UI. (CVE-2026-57963)

  - A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete,     can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it     crashes due to memory exhaustion. (CVE-2026-57962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-64 advisory.

  - An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content,     phishing links, and CSS that manipulates the chat UI. (CVE-2026-57963)

  - A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete,     can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it     crashes due to memory exhaustion. (CVE-2026-57962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 152.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-63 advisory.

  - An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content,     phishing links, and CSS that manipulates the chat UI. (CVE-2026-57963)

  - A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete,     can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it     crashes due to memory exhaustion. (CVE-2026-57962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333600	Debian dla-4727 : thunderbird - security update	Nessus	Debian Local Security Checks	Local	critical
333528	Debian dsa-6418 : thunderbird - security update	Nessus	Debian Local Security Checks	Local	critical
324677	Linux Distros Unpatched Vulnerability : CVE-2026-57963	Nessus	Misc.	Local	medium
324037	Mozilla Thunderbird < 140.12.1	Nessus	MacOS X Local Security Checks	Local	medium
324036	Mozilla Thunderbird < 152.0.1	Nessus	MacOS X Local Security Checks	Local	medium
324035	Mozilla Thunderbird < 140.12.1	Nessus	Windows	Local	medium
324034	Mozilla Thunderbird < 152.0.1	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2026-57963

medium

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium