The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-05 advisory.

  - Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird     146, Firefox ESR 140.7, and Thunderbird 140.7. (CVE-2025-14327)

  - Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR     115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. (CVE-2026-0877)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
    (CVE-2026-0878)

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
    (CVE-2026-0879)

  - Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox     147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. (CVE-2026-0880)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Mozilla Thunderbird < 140.7

high Nessus Plugin ID 284837

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 22, 2026, 12:02 AM Plugin metadata Plugin Feed: 202610220002
Version 1.2 Jan 21, 2026, 5:00 PM IAVM reference Plugin Feed: 202601211700
Version 1.1 Jan 15, 2026, 10:31 PM New Plugin Feed: 202601152231