Mozilla MFSA 2026-102 Fixes Security Vulnerabilities in Thunderbird 140.17
Tech GuruQuick Answer
For Thunderbird clients maintained on the 140 branch, MFSA 2026-102 supplies the security fixes in 140.17. Use the supported update channel and verify the version after restart; this notice is not an instruction to migrate those clients to 157. Mozilla's general warning that most listed flaws are not reachable during ordinary mail reading has an important exception: CVE-2026-103500 describes an overflow when opening an email at least 2 GB in size.
Confirm Scope And Apply The Supported Fix
What to do now: Find affected 140-branch installations, preserve their mail profiles and install 140.17 or a later supported fixed release on that branch. For distribution-maintained builds, establish the package's fix status from the distribution advisory rather than the upstream display version alone.
Last verified: 2026-10-02 UTC. Recheck MFSA 2026-102 and the supported package or application channel before changing clients.
Scope And Authority
| Product scope | Mozilla Thunderbird 140.17 |
|---|---|
| Advisory | MFSA 2026-102 |
| CVEs | CVE-2026-100756, CVE-2026-100757, CVE-2026-100758, CVE-2026-100759, CVE-2026-100762, CVE-2026-100766, CVE-2026-100767, CVE-2026-100769, CVE-2026-100770, CVE-2026-100771, CVE-2026-100772, CVE-2026-100773, CVE-2026-100774, CVE-2026-100775, CVE-2026-100776, CVE-2026-100777, CVE-2026-100778, CVE-2026-100779, CVE-2026-100780, CVE-2026-100781, CVE-2026-100782, CVE-2026-100783, CVE-2026-100784, CVE-2026-100785, CVE-2026-100786, CVE-2026-100788, CVE-2026-100789, CVE-2026-100790, CVE-2026-100791, CVE-2026-100792, CVE-2026-100794, CVE-2026-100797, CVE-2026-100801, CVE-2026-100803, CVE-2026-100807, CVE-2026-100811, CVE-2026-100818, CVE-2026-100819, CVE-2026-100820, CVE-2026-100821, CVE-2026-100832, CVE-2026-103500, CVE-2026-92035, CVE-2026-96869 |
| Authoritative release date | 2026-09-30 (Mozilla announced date; no time stated) |
| Authority revision date | No separate material revision date stated by Mozilla when verified |
| Affected versions | Earlier affected Thunderbird 140-branch builds; fixed upstream in 140.17. Other maintained branches have separate advisories and fixed releases. |
| Fixed version | Thunderbird 140.17 |
| CVSS base score | Not provided by the authority |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Among the 44 listed CVEs, Mozilla rates the Graphics sandbox escape CVE-2026-92035 and Canvas2D use-after-free CVE-2026-100832 High. These browser-component issues do not establish that ordinary email can trigger every flaw: scripting is disabled while reading mail. Conversely, that caveat must not hide the separately described oversized-email overflow, which Mozilla rates Low. Leave mail scripting disabled and do not create a huge-message test on a live mailbox.
What To Validate Now
- Confirm the 140 branch. Record the installed version, application source and management policy. A separate maintained branch should be evaluated under its own Mozilla or distribution advisory.
- Protect local state. Save drafts, close the client for the approved profile backup and confirm that locally stored mail is covered. Resolve recovery arrangements before changing a workstation with the only copy of a mailbox.
- Apply the supported update. In a manually installed client, choose Help > About Thunderbird, or Thunderbird > About Thunderbird on macOS. Allow the update check/download and select Restart Thunderbird to Update. Distribution-packaged Linux installations must follow the distribution's repository and fixed-package guidance.
- Read back and exercise normal use. After restart, confirm 140.17 or the applicable later fixed build. Test ordinary send/receive, configured calendars and required extensions; check S/MIME signing and decryption only where those workflows are configured. Do not enable scripting or use malicious content as a validation shortcut.
- Document exceptions. Record the before/after version, package origin and benign test results. Keep credentials, private keys and message bodies out of change tickets; unresolved client failures need an owner before wider rollout.
Operational Cautions
The Mozilla update procedure does not validate your extensions or recover a damaged mail profile. Keep the approved channel and recovery plan; an improvised channel switch or downgrade is a separate compatibility risk. Mozilla does not state exploitation in this advisory, and normal mail tests cannot prove absence of a prior compromise.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
