# Mozilla Thunderbird (ja) 136.0

Mozilla Thunderbird (ja) 136.0, released March 4, 2025, fixes 87 CVEs in Mozilla Thunderbird (ja). One of them is being exploited (CVE-2024-9680); 1 on CISA KEV. Patch Radar priority: Patch now. The latest Mozilla Thunderbird (ja) is 159.0, which also fixes every one of these CVEs.

- Web page: https://patchblox.com/security/fix/windows-app/mozilla.thunderbird.ja-136.0
- Platform: Windows apps
- Released: Mar 4, 2025
- Priority: Patch now (Closes CVE-2024-9680, exploited (CISA KEV, ransomware))
- CVEs: 87, exploited: 1, on CISA KEV: 1
- Superseded by: [Mozilla Thunderbird (ja) 159.0](https://patchblox.com/security/data/product/windows-app/mozilla-thunderbird-ja.md), the latest version, which also fixes every CVE listed here

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Mozilla Thunderbird (ja)](https://patchblox.com/security/data/product/windows-app/mozilla-thunderbird-ja.md) |  | 136.0 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-9680](https://patchblox.com/security/data/cve/CVE-2024-9680.md) | Patch now | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.2318 | CISA KEV, Ransomware |
| [CVE-2024-11704](https://patchblox.com/security/data/cve/CVE-2024-11704.md) | Urgent | Mozilla Firefox ESR and 8 others: Double Free | 9.8 | 0.0091 |  |
| [CVE-2024-11693](https://patchblox.com/security/data/cve/CVE-2024-11693.md) | Urgent | Mozilla Firefox ESR and 8 others: The executable file warning was not presented when downloading .library-ms files. | 9.8 | 0.0083 |  |
| [CVE-2025-0242](https://patchblox.com/security/data/cve/CVE-2025-0242.md) | High | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 | 8.8 | 0.1472 |  |
| [CVE-2025-0247](https://patchblox.com/security/data/cve/CVE-2025-0247.md) | High | Memory safety bugs fixed in Firefox 134 and Thunderbird 134 | 9.8 | 0.1061 |  |
| [CVE-2024-8381](https://patchblox.com/security/data/cve/CVE-2024-8381.md) | High | Mozilla Firefox ESR and 6 others: Access of Resource Using Incompatible Type ('Type Confusion') | 9.8 | 0.0440 |  |
| [CVE-2024-10466](https://patchblox.com/security/data/cve/CVE-2024-10466.md) | High | Mozilla Firefox ESR and 7 others: Uncontrolled Resource Consumption | 7.5 | 0.0081 |  |
| [CVE-2024-11697](https://patchblox.com/security/data/cve/CVE-2024-11697.md) | High | Mozilla Firefox ESR and 8 others: Improper Control of Generation of Code ('Code Injection') | 8.8 | 0.0081 |  |
| [CVE-2024-9401](https://patchblox.com/security/data/cve/CVE-2024-9401.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 9.8 | 0.0074 |  |
| [CVE-2025-0241](https://patchblox.com/security/data/cve/CVE-2025-0241.md) | High | Memory corruption when using JavaScript Text Segmentation | 7.7 | 0.0073 |  |
| [CVE-2024-11699](https://patchblox.com/security/data/cve/CVE-2024-11699.md) | High | Mozilla Firefox ESR and 8 others: Improper Control of Generation of Code ('Code Injection') | 8.8 | 0.0072 |  |
| [CVE-2024-8384](https://patchblox.com/security/data/cve/CVE-2024-8384.md) | High | Mozilla Firefox ESR and 6 others: Use After Free | 9.8 | 0.0072 |  |
| [CVE-2024-6611](https://patchblox.com/security/data/cve/CVE-2024-6611.md) | High | Incorrect handling of SameSite cookies | 9.8 | 0.0066 |  |
| [CVE-2024-11705](https://patchblox.com/security/data/cve/CVE-2024-11705.md) | High | Mozilla Firefox ESR and 8 others: NULL Pointer Dereference | 9.1 | 0.0066 |  |
| [CVE-2024-10458](https://patchblox.com/security/data/cve/CVE-2024-10458.md) | High | Mozilla Firefox ESR and 7 others: Improper Preservation of Permissions | 8.2 | 0.0064 |  |
| [CVE-2024-7520](https://patchblox.com/security/data/cve/CVE-2024-7520.md) | High | Mozilla Firefox ESR and 6 others: Improper Control of Generation of Code ('Code Injection') | 9.6 | 0.0064 |  |
| [CVE-2024-10459](https://patchblox.com/security/data/cve/CVE-2024-10459.md) | High | Mozilla Firefox ESR and 7 others: Use After Free | 7.6 | 0.0063 |  |
| [CVE-2025-1011](https://patchblox.com/security/data/cve/CVE-2025-1011.md) | High | A bug in WebAssembly code generation could result in a crash | 8.8 | 0.0063 |  |
| [CVE-2024-10467](https://patchblox.com/security/data/cve/CVE-2024-10467.md) | High | Mozilla Firefox ESR and 7 others: Out-of-bounds Read | 8.8 | 0.0063 |  |
| [CVE-2024-9402](https://patchblox.com/security/data/cve/CVE-2024-9402.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 9.8 | 0.0062 |  |
| [CVE-2024-8382](https://patchblox.com/security/data/cve/CVE-2024-8382.md) | High | Mozilla Firefox ESR and 6 others: Improper Check for Dropped Privileges | 8.8 | 0.0060 |  |
| [CVE-2024-9396](https://patchblox.com/security/data/cve/CVE-2024-9396.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.8 | 0.0059 |  |
| [CVE-2024-6609](https://patchblox.com/security/data/cve/CVE-2024-6609.md) | High | Memory corruption in NSS | 8.8 | 0.0058 |  |
| [CVE-2024-8385](https://patchblox.com/security/data/cve/CVE-2024-8385.md) | High | Mozilla Firefox ESR and 7 others: Access of Resource Using Incompatible Type ('Type Confusion') | 9.8 | 0.0058 |  |
| [CVE-2024-6607](https://patchblox.com/security/data/cve/CVE-2024-6607.md) | High | Leaving pointerlock by pressing the escape key could be prevented | 8.8 | 0.0056 |  |
| [CVE-2025-1937](https://patchblox.com/security/data/cve/CVE-2025-1937.md) | High | Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 | 8.8 | 0.0056 |  |
| [CVE-2025-1931](https://patchblox.com/security/data/cve/CVE-2025-1931.md) | High | Use-after-free in WebTransportChild | 8.8 | 0.0054 |  |
| [CVE-2024-9392](https://patchblox.com/security/data/cve/CVE-2024-9392.md) | High | Mozilla Firefox ESR and 7 others: Origin Validation Error | 9.8 | 0.0054 |  |
| [CVE-2024-11702](https://patchblox.com/security/data/cve/CVE-2024-11702.md) | High | Mozilla Firefox ESR and 8 others: Inappropriate Encoding for Output Context | 7.5 | 0.0053 |  |
| [CVE-2024-9394](https://patchblox.com/security/data/cve/CVE-2024-9394.md) | High | Mozilla Firefox ESR and 7 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 7.6 | 0.0052 |  |
| [CVE-2024-11694](https://patchblox.com/security/data/cve/CVE-2024-11694.md) | High | Mozilla Firefox ESR and 8 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 8.8 | 0.0052 |  |
| [CVE-2024-7528](https://patchblox.com/security/data/cve/CVE-2024-7528.md) | High | Mozilla Firefox ESR and 6 others: Use After Free | 9.6 | 0.0052 |  |
| [CVE-2025-3030](https://patchblox.com/security/data/cve/CVE-2025-3030.md) | High | Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 | 8.8 | 0.0051 |  |
| [CVE-2024-7518](https://patchblox.com/security/data/cve/CVE-2024-7518.md) | High | Mozilla Firefox ESR and 6 others: Improper Restriction of Rendered UI Layers or Frames | 9.6 | 0.0051 |  |
| [CVE-2024-11700](https://patchblox.com/security/data/cve/CVE-2024-11700.md) | High | Mozilla Firefox ESR and 8 others: Improper Restriction of Rendered UI Layers or Frames | 8.1 | 0.0051 |  |
| [CVE-2024-9400](https://patchblox.com/security/data/cve/CVE-2024-9400.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.8 | 0.0051 |  |
| [CVE-2024-9399](https://patchblox.com/security/data/cve/CVE-2024-9399.md) | High | Mozilla Firefox ESR and 7 others: Improper Resource Shutdown or Release | 7.5 | 0.0050 |  |
| [CVE-2024-11692](https://patchblox.com/security/data/cve/CVE-2024-11692.md) | High | Mozilla Firefox ESR and 8 others: Authentication Bypass by Spoofing | 8.8 | 0.0049 |  |
| [CVE-2025-4093](https://patchblox.com/security/data/cve/CVE-2025-4093.md) | High | Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 | 8.8 | 0.0049 |  |
| [CVE-2025-1942](https://patchblox.com/security/data/cve/CVE-2025-1942.md) | High | Disclosure of uninitialized memory when .toUpperCase() causes string to get longer | 9.8 | 0.0048 |  |
| [CVE-2025-5269](https://patchblox.com/security/data/cve/CVE-2025-5269.md) | High | Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11 | 8.8 | 0.0048 |  |
| [CVE-2024-11695](https://patchblox.com/security/data/cve/CVE-2024-11695.md) | High | Mozilla Firefox ESR and 8 others: Improper Restriction of Rendered UI Layers or Frames | 8.8 | 0.0046 |  |
| [CVE-2025-1934](https://patchblox.com/security/data/cve/CVE-2025-1934.md) | High | Unexpected GC during RegExp bailout processing | 8.8 | 0.0045 |  |
| [CVE-2025-1012](https://patchblox.com/security/data/cve/CVE-2025-1012.md) | High | Use-after-free during concurrent delazification | 8.8 | 0.0045 |  |
| [CVE-2024-6615](https://patchblox.com/security/data/cve/CVE-2024-6615.md) | High | Memory safety bugs fixed in Firefox 128 and Thunderbird 128 | 8.8 | 0.0045 |  |
| [CVE-2025-1936](https://patchblox.com/security/data/cve/CVE-2025-1936.md) | High | Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents | 8.8 | 0.0045 |  |
| [CVE-2024-9403](https://patchblox.com/security/data/cve/CVE-2024-9403.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 7.5 | 0.0045 |  |
| [CVE-2025-1943](https://patchblox.com/security/data/cve/CVE-2025-1943.md) | High | Memory safety bugs fixed in Firefox 136 and Thunderbird 136 | 8.2 | 0.0043 |  |
| [CVE-2024-8900](https://patchblox.com/security/data/cve/CVE-2024-8900.md) | High | Mozilla Firefox ESR and 7 others: Incorrect Permission Assignment for Critical Resource | 7.5 | 0.0043 |  |
| [CVE-2025-1932](https://patchblox.com/security/data/cve/CVE-2025-1932.md) | High | Inconsistent comparator in XSLT sorting led to out-of-bounds access | 8.8 | 0.0042 |  |
| [CVE-2025-1930](https://patchblox.com/security/data/cve/CVE-2025-1930.md) | High | AudioIPC StreamData could trigger a use-after-free in the Browser process | 8.8 | 0.0040 |  |
| [CVE-2024-6606](https://patchblox.com/security/data/cve/CVE-2024-6606.md) | High | Out-of-bounds read in clipboard component | 8.2 | 0.0040 |  |
| [CVE-2024-9393](https://patchblox.com/security/data/cve/CVE-2024-9393.md) | High | Mozilla Firefox ESR and 7 others: Origin Validation Error | 7.6 | 0.0040 |  |
| [CVE-2024-6601](https://patchblox.com/security/data/cve/CVE-2024-6601.md) | High | Race condition in permission assignment | 7.5 | 0.0039 |  |
| [CVE-2024-11696](https://patchblox.com/security/data/cve/CVE-2024-11696.md) | High | Mozilla Firefox ESR and 8 others: Improper Verification of Cryptographic Signature | 8.8 | 0.0036 |  |
| [CVE-2025-26696](https://patchblox.com/security/data/cve/CVE-2025-26696.md) | High | Crafted email message incorrectly shown as being encrypted | 7.0 | 0.0036 |  |
| [CVE-2025-1935](https://patchblox.com/security/data/cve/CVE-2025-1935.md) | High | Clickjacking the registerProtocolHandler info-bar | 8.8 | 0.0034 |  |
| [CVE-2025-1938](https://patchblox.com/security/data/cve/CVE-2025-1938.md) | High | Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 | 8.8 | 0.0034 |  |
| [CVE-2025-1013](https://patchblox.com/security/data/cve/CVE-2025-1013.md) | High | Potential opening of private browsing tabs in normal browsing windows | 8.8 | 0.0033 |  |
| [CVE-2025-1933](https://patchblox.com/security/data/cve/CVE-2025-1933.md) | High | JIT corruption of WASM i32 return values on 64-bit CPUs | 8.8 | 0.0032 |  |
| [CVE-2025-0243](https://patchblox.com/security/data/cve/CVE-2025-0243.md) | High | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 | 7.5 | 0.0025 |  |
| [CVE-2025-0238](https://patchblox.com/security/data/cve/CVE-2025-0238.md) | Routine | Use-after-free when breaking lines in text | 6.5 | 0.0079 |  |
| [CVE-2024-10463](https://patchblox.com/security/data/cve/CVE-2024-10463.md) | Routine | Mozilla Firefox ESR and 7 others: Observable Discrepancy | 6.5 | 0.0073 |  |
| [CVE-2025-0240](https://patchblox.com/security/data/cve/CVE-2025-0240.md) | Routine | Compartment mismatch when parsing JavaScript JSON module | 6.5 | 0.0067 |  |
| [CVE-2024-10464](https://patchblox.com/security/data/cve/CVE-2024-10464.md) | Routine | Mozilla Firefox ESR and 7 others: Out-of-bounds Read | 6.5 | 0.0064 |  |
| [CVE-2024-10461](https://patchblox.com/security/data/cve/CVE-2024-10461.md) | Routine | Mozilla Firefox ESR and 7 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.1 | 0.0060 |  |
| [CVE-2025-0237](https://patchblox.com/security/data/cve/CVE-2025-0237.md) | Routine | WebChannel APIs susceptible to confused deputy attack | 6.8 | 0.0060 |  |
| [CVE-2024-9398](https://patchblox.com/security/data/cve/CVE-2024-9398.md) | Routine | Mozilla Firefox ESR and 7 others: Observable Discrepancy | 5.3 | 0.0057 |  |
| [CVE-2024-10462](https://patchblox.com/security/data/cve/CVE-2024-10462.md) | Routine | Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing | 6.5 | 0.0057 |  |
| [CVE-2024-10465](https://patchblox.com/security/data/cve/CVE-2024-10465.md) | Routine | Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing | 6.5 | 0.0057 |  |
| [CVE-2024-6612](https://patchblox.com/security/data/cve/CVE-2024-6612.md) | Routine | CSP violation leakage when using devtools | 5.3 | 0.0050 |  |
| [CVE-2024-11706](https://patchblox.com/security/data/cve/CVE-2024-11706.md) | Routine | Mozilla Firefox ESR and 8 others: NULL Pointer Dereference | 6.5 | 0.0050 |  |
| [CVE-2025-4084](https://patchblox.com/security/data/cve/CVE-2025-4084.md) | Routine | Potential local code execution in "copy as cURL" command | 5.7 | 0.0045 |  |
| [CVE-2024-11701](https://patchblox.com/security/data/cve/CVE-2024-11701.md) | Routine | Mozilla Firefox ESR and 8 others: Authentication Bypass by Spoofing | 4.3 | 0.0042 |  |
| [CVE-2024-10468](https://patchblox.com/security/data/cve/CVE-2024-10468.md) | Routine | Mozilla Firefox ESR and 7 others: Allocation of Resources Without Limits or Throttling | 5.3 | 0.0042 |  |
| [CVE-2024-8386](https://patchblox.com/security/data/cve/CVE-2024-8386.md) | Routine | Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing | 6.1 | 0.0039 |  |
| [CVE-2024-6608](https://patchblox.com/security/data/cve/CVE-2024-6608.md) | Routine | Cursor could be moved out of the viewport using pointerlock. | 4.3 | 0.0038 |  |
| [CVE-2024-9397](https://patchblox.com/security/data/cve/CVE-2024-9397.md) | Routine | Mozilla Firefox ESR and 7 others: Improper Restriction of Rendered UI Layers or Frames | 6.1 | 0.0037 |  |
| [CVE-2024-6614](https://patchblox.com/security/data/cve/CVE-2024-6614.md) | Routine | Incorrect listing of stack frames | 4.3 | 0.0037 |  |
| [CVE-2024-11708](https://patchblox.com/security/data/cve/CVE-2024-11708.md) | Routine | Mozilla Firefox ESR and 8 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 6.5 | 0.0035 |  |
| [CVE-2024-10460](https://patchblox.com/security/data/cve/CVE-2024-10460.md) | Routine | Mozilla Firefox ESR and 7 others: Origin Validation Error | 5.3 | 0.0034 |  |
| [CVE-2024-6610](https://patchblox.com/security/data/cve/CVE-2024-6610.md) | Routine | Form validation popups could block exiting full-screen mode | 4.3 | 0.0034 |  |
| [CVE-2024-8394](https://patchblox.com/security/data/cve/CVE-2024-8394.md) | Routine | Mozilla Thunderbird and 2 others: Use After Free | 6.5 | 0.0033 |  |
| [CVE-2024-11159](https://patchblox.com/security/data/cve/CVE-2024-11159.md) | Routine | Mozilla Thunderbird ESR and 2 others: Cleartext Storage of Sensitive Information | 4.3 | 0.0031 |  |
| [CVE-2025-0239](https://patchblox.com/security/data/cve/CVE-2025-0239.md) | Routine | Alt-Svc ALPN validation failure when redirected | 5.4 | 0.0023 |  |
| [CVE-2024-6613](https://patchblox.com/security/data/cve/CVE-2024-6613.md) | Routine | Incorrect listing of stack frames | 5.5 | 0.0019 |  |
| [CVE-2025-26695](https://patchblox.com/security/data/cve/CVE-2025-26695.md) | Routine | Downloading of OpenPGP keys from WKD used incorrect padding | 5.3 | 0.0016 |  |

---

Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.