CVE-2026-100810 – Mozilla Thunderbird

CVSS 9.8 CRITICAL [2] Critical – Same Day Deployment

“Nine critical flaws in the inbox mean every unpatched mail client is an open door into the enterprise.”

Mozilla has fixed nine Critical vulnerabilities in Thunderbird across graphics, WebAssembly, internationalization, preferences, DevTools, the DOM, the Gtk widget layer, mail header parsing, and the IMAP response parser. Four of these flaws allow sandbox escape, and two sit directly in the mail-handling path: a crafted mail header can trigger memory safety violations, and a malicious or compromised IMAP server can crash Thunderbird before authentication.

CVE-2026-100788, CVE-2026-100810, and CVE-2026-92238 each have a CVSS score of 9.8, Critical severity. CVE-2026-100794, CVE-2026-100804, CVE-2026-100811, and CVE-2026-100818 each have a CVSS score of 9.6, Critical severity. CVE-2026-100763 and CVE-2026-92240 each have a CVSS score of 9.1, Critical severity. The fixes ship in Thunderbird 157, 153.4, and 140.17, with the mail header and IMAP fixes first delivered in Thunderbird 156, 153.3, and 140.16.

Key Details

Affected Product: Mozilla Firefox
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
CWE Classification: CWE-200

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.