Mozilla Thunderbird < 158.0.1

critical Nessus Plugin ID 369077

Language:

Synopsis

A mail client installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

- Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

- When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

- Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. (CVE-2026-113867)

- When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. (CVE-2026-113868)

- When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Mozilla Thunderbird version 158.0.1 or later.

Plugin Details

Severity: Critical

ID: 369077

File Name: mozilla_thunderbird_158_0_1.nasl

Version: 1.4

Type: Local

Agent: windows

Family: Windows

Published: 10/21/2026

Updated: 10/30/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.1

Percentile: 95.56

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-113470

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-113399

Vulnerability Information

CPE: cpe:/a:mozilla:thunderbird

Required KB Items: installed_sw/Mozilla Thunderbird

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-113399, CVE-2026-113400, CVE-2026-113401, CVE-2026-113470, CVE-2026-113866, CVE-2026-113867, CVE-2026-113868, CVE-2026-113869

IAVA: 2026-A-1137

Detections

Analytics