ALSA-2026:19348: thunderbird security update

ALSA-2026:19348, released May 19, 2026, fixes 30 CVEs in thunderbird (version 140.10.1-1.el9_8.alma.1). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0388

90th percentile

Priority of the 30 CVEs

Patch now 0
                                Urgent 0
                                High 30
                                Routine 0

Fixed package versions

Product	Release	Fixed in
thunderbird	almalinux 9	140.10.1-1.el9_8.alma.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-6770	Other issue in the Storage: IndexedDB component	8.8	0.0388	None reported
High	CVE-2026-6746	Use-after-free in the DOM: Core & HTML component	8.8	0.0095	None reported
High	CVE-2026-6785	Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150	8.8	0.0051	None reported
High	CVE-2026-6786	Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150	8.8	0.0050	None reported
High	CVE-2026-6757	Invalid pointer in the JavaScript: WebAssembly component	8.8	0.0049	None reported
High	CVE-2026-6750	Privilege escalation in the Graphics: WebRender component	8.8	0.0048	None reported
High	CVE-2026-8091	Incorrect boundary conditions in the Audio/Video: Playback component	9.8	0.0047	None reported
High	CVE-2026-6749	Information disclosure due to uninitialized memory in the Graphics: Canvas2D component	8.8	0.0040	None reported
High	CVE-2026-6747	Use-after-free in the WebRTC component	8.8	0.0040	None reported
High	CVE-2026-6748	Uninitialized memory in the Audio/Video: Web Codecs component	9.8	0.0040	None reported
High	CVE-2026-6772	Incorrect boundary conditions in the Libraries component in NSS	8.8	0.0039	None reported
High	CVE-2026-6754	Use-after-free in the JavaScript Engine component	8.8	0.0039	None reported
High	CVE-2026-7323	Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1	8.8	0.0038	None reported
High	CVE-2026-6759	Use-after-free in the Widget: Cocoa component	8.8	0.0036	None reported
High	CVE-2026-7320	Information disclosure due to incorrect boundary conditions in the Audio/Video component	8.8	0.0032	None reported
High	CVE-2026-7322	Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1	8.8	0.0032	None reported
High	CVE-2026-6771	Mitigation bypass in the DOM: Security component	9.8	0.0031	None reported
High	CVE-2026-6751	Uninitialized memory in the Audio/Video: Web Codecs component	8.8	0.0031	None reported
High	CVE-2026-6752	Incorrect boundary conditions in the WebRTC component	8.8	0.0031	None reported
High	CVE-2026-6753	Incorrect boundary conditions in the WebRTC component	8.8	0.0031	None reported
High	CVE-2026-7321	Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component	9.6	0.0026	None reported
High	CVE-2026-6766	Incorrect boundary conditions in the Libraries component in NSS	8.8	0.0026	None reported
High	CVE-2026-6764	Incorrect boundary conditions in the DOM: Device Interfaces component	8.8	0.0023	None reported
High	CVE-2026-6767	Other issue in the Libraries component in NSS	8.8	0.0023	None reported
High	CVE-2026-6769	Privilege escalation in the Debugger component	8.8	0.0023	None reported

Also fixes CVE-2026-6770

RHSA-2026:19463
thunderbird on RHEL 10
RHSA-2026:13537
thunderbird on RHEL 8
ELSA-2026-13537
thunderbird on ol 8
ALSA-2026:13537
thunderbird on almalinux 8
RHSA-2026:17690
firefox on RHEL 10
RHSA-2026:10766
firefox on RHEL 8
ALSA-2026:10766
firefox on almalinux 8
ELSA-2026-10766
firefox on ol 8

Vendor advisory

https://osv.dev/vulnerability/ALSA-2026:19348

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alsa-2026-19348">ALSA-2026:19348 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.