Mozilla Thunderbird 159 and 153.6 Fix 175 Security CVEs
Tech GuruQuick Answer
Mozilla MFSA 2026-121 and MFSA 2026-122 fix 175 unique CVEs in Thunderbird 159 and 153.6. Inventory maintained branches, deploy the matching update, prioritize Windows and network-share exposure, validate mail, calendar, RSS, chat and encryption workflows, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Thunderbird installations and branches, Windows clients, OpenPGP and S/MIME use, calendars, RSS and Matrix accounts, network-share access, update policy, extensions, owners, and offline systems. Match each client to MFSA 2026-121 or MFSA 2026-122 and its fixed branch; do not infer that every browser-engine issue is reachable through email, and do not ignore Thunderbird-specific URL and message paths. Deploy Thunderbird 159 or 153.6 through the supported update channel for the maintained branch and address clients that cannot receive a supported release. Confirm the active version after restart, test mail display and composition, OpenPGP or S/MIME, calendars, RSS, Matrix and enterprise policy as used, review anomalous SMB or remote-content connections where warranted, and retain fleet evidence.
Last verified: 2026-10-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Mozilla Thunderbird 159 and Thunderbird 153.6 |
|---|---|
| Advisory | MFSA 2026-121 / MFSA 2026-122 |
| CVEs | CVE-2026-100801, CVE-2026-110247, CVE-2026-113869, CVE-2026-117860, CVE-2026-117861, CVE-2026-117862, CVE-2026-117863, CVE-2026-117864, CVE-2026-117865, CVE-2026-117866, CVE-2026-117867, CVE-2026-117868, CVE-2026-117869, CVE-2026-117870, CVE-2026-117871, CVE-2026-117872, CVE-2026-117873, CVE-2026-117874, CVE-2026-117875, CVE-2026-117876, CVE-2026-117877, CVE-2026-117878, CVE-2026-117879, CVE-2026-117880, CVE-2026-117881, CVE-2026-117882, CVE-2026-117883, CVE-2026-117884, CVE-2026-117885, CVE-2026-117886, CVE-2026-117887, CVE-2026-117888, CVE-2026-117889, CVE-2026-117890, CVE-2026-117891, CVE-2026-117892, CVE-2026-117893, CVE-2026-117894, CVE-2026-117895, CVE-2026-117896, CVE-2026-117897, CVE-2026-117898, CVE-2026-117899, CVE-2026-117900, CVE-2026-117901, CVE-2026-117902, CVE-2026-117903, CVE-2026-117904, CVE-2026-117905, CVE-2026-117906, CVE-2026-117907, CVE-2026-117908, CVE-2026-117909, CVE-2026-117910, CVE-2026-117911, CVE-2026-117912, CVE-2026-117913, CVE-2026-117914, CVE-2026-117915, CVE-2026-117916, CVE-2026-117917, CVE-2026-117918, CVE-2026-117919, CVE-2026-117920, CVE-2026-117921, CVE-2026-117922, CVE-2026-117923, CVE-2026-117924, CVE-2026-117925, CVE-2026-117926, CVE-2026-117927, CVE-2026-117928, CVE-2026-117929, CVE-2026-117930, CVE-2026-117931, CVE-2026-117932, CVE-2026-117933, CVE-2026-117934, CVE-2026-117935, CVE-2026-117936, CVE-2026-117937, CVE-2026-117938, CVE-2026-117939, CVE-2026-117940, CVE-2026-117941, CVE-2026-117942, CVE-2026-117943, CVE-2026-117944, CVE-2026-117945, CVE-2026-117946, CVE-2026-117947, CVE-2026-117948, CVE-2026-117949, CVE-2026-117950, CVE-2026-117951, CVE-2026-117952, CVE-2026-117953, CVE-2026-117954, CVE-2026-117955, CVE-2026-117956, CVE-2026-117957, CVE-2026-117958, CVE-2026-117959, CVE-2026-117960, CVE-2026-117961, CVE-2026-117962, CVE-2026-117963, CVE-2026-117964, CVE-2026-117965, CVE-2026-117966, CVE-2026-117967, CVE-2026-117968, CVE-2026-117969, CVE-2026-117970, CVE-2026-117971, CVE-2026-117972, CVE-2026-117973, CVE-2026-117974, CVE-2026-117975, CVE-2026-117976, CVE-2026-117977, CVE-2026-117978, CVE-2026-117979, CVE-2026-117980, CVE-2026-117981, CVE-2026-117982, CVE-2026-117983, CVE-2026-117984, CVE-2026-117985, CVE-2026-117986, CVE-2026-117987, CVE-2026-117988, CVE-2026-117989, CVE-2026-117990, CVE-2026-117991, CVE-2026-117992, CVE-2026-117993, CVE-2026-117994, CVE-2026-117995, CVE-2026-117996, CVE-2026-117997, CVE-2026-117998, CVE-2026-117999, CVE-2026-118000, CVE-2026-118002, CVE-2026-118003, CVE-2026-118004, CVE-2026-118005, CVE-2026-118006, CVE-2026-118007, CVE-2026-118008, CVE-2026-118009, CVE-2026-118010, CVE-2026-118011, CVE-2026-118012, CVE-2026-118013, CVE-2026-118014, CVE-2026-118015, CVE-2026-118016, CVE-2026-118017, CVE-2026-118019, CVE-2026-118020, CVE-2026-118021, CVE-2026-118022, CVE-2026-118023, CVE-2026-118024, CVE-2026-118025, CVE-2026-118026, CVE-2026-118174, CVE-2026-118175, CVE-2026-118176, CVE-2026-118177, CVE-2026-118178, CVE-2026-118179, CVE-2026-118180 |
| Authoritative release date | 2026-10-27 23:00:00 UTC |
| Authority revision date | 2026-10-27 23:00:00 UTC |
| Affected versions | Thunderbird branches before 159 and 153.6 as applicable. Several Thunderbird-specific flaws involve OpenPGP attachments, message composition, UNC paths, calendar discovery, RSS redirection, news links, Matrix homeservers, MIME processing, and S/MIME decryption. |
| Fixed version | Thunderbird 159 or Thunderbird 153.6 for the corresponding branch |
| CVSS base score | Not provided by the authority |
| CVSS severity | Low to High |
| Exploitation status | Mozilla does not state in these advisories that the listed vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Mozilla published two High-impact Thunderbird advisories covering 175 unique CVEs. The releases include Thunderbird-specific remote-content, information-disclosure, local-file and network-share, request-forgery, memory-safety, and shared browser-engine fixes.
What To Validate Now
- Inventory. Inventory Thunderbird installations and branches, Windows clients, OpenPGP and S/MIME use, calendars, RSS and Matrix accounts, network-share access, update policy, extensions, owners, and offline systems.
- Establish applicability. Match each client to MFSA 2026-121 or MFSA 2026-122 and its fixed branch; do not infer that every browser-engine issue is reachable through email, and do not ignore Thunderbird-specific URL and message paths.
- Remediate. Deploy Thunderbird 159 or 153.6 through the supported update channel for the maintained branch and address clients that cannot receive a supported release.
- Validate. Confirm the active version after restart, test mail display and composition, OpenPGP or S/MIME, calendars, RSS, Matrix and enterprise policy as used, review anomalous SMB or remote-content connections where warranted, and retain fleet evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Mozilla notes that scripting is disabled while reading mail, limiting many shared engine flaws, but several Thunderbird-specific issues require only displaying or interacting with crafted content. Test add-ons and managed configuration before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
