The version of Thunderbird installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in     Firefox 149 and Thunderbird 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in     Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox     149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. (CVE-2026-4685,     CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Mozilla Thunderbird < 149.0

critical Nessus Plugin ID 303506

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Oct 22, 2026, 12:02 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") Plugin metadata Plugin Feed: 202610220002
Version 1.3 May 1, 2026, 7:22 AM IAVM reference Plugin Feed: 202605010722
Version 1.2 Mar 27, 2026, 2:12 PM New Plugin Feed: 202603271412
Version 1.1 Mar 25, 2026, 3:40 AM New Plugin Feed: 202603250340