Linux · openSUSE Leap · Security advisory · June 29, 2026

OPENSUSE-SU-2026:21168-1: MozillaThunderbird security update

OPENSUSE-SU-2026:21168-1, released June 29, 2026, fixes 56 CVEs in MozillaThunderbird (version 140.12.0-bp160.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
56
6 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0061
49th percentile

Priority of the 56 CVEs

Patch now 0 Urgent 6 High 50 Routine 0

Fixed package versions

ProductReleaseFixed in
MozillaThunderbirdopensuse-leap 16.0140.12.0-bp160.1.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-12295 Sandbox escape in the DOM: Navigation component9.6 0.0039 None reported
Urgent CVE-2026-12296 Sandbox escape in the Security: Process Sandboxing component9.6 0.0039 None reported
Urgent CVE-2026-12297 Sandbox escape due to incorrect boundary conditions in the Networking component9.6 0.0039 None reported
Urgent CVE-2026-12294 Sandbox escape in the DOM: Workers component9.6 0.0036 None reported
Urgent CVE-2026-12315 Mitigation bypass in the DOM: Security component9.1 0.0025 None reported
Urgent CVE-2026-12304 Same-origin policy bypass in the Networking: Cookies component9.1 0.0019 None reported
High CVE-2026-8956 Integer overflow in the Networking: JAR component9.8 0.0061 None reported
High CVE-2026-8949 Integer overflow in the Widget: Win32 component7.5 0.0058 None reported
High CVE-2026-8946 Incorrect boundary conditions in the Audio/Video: Web Codecs component7.5 0.0056 None reported
High CVE-2026-8953 Sandbox escape due to use-after-free in the Disability Access APIs component9.6 0.0053 None reported
High CVE-2026-12292 Incorrect boundary conditions in the Web Audio component8.1 0.0049 None reported
High CVE-2026-12328 Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 1528.1 0.0048 None reported
High CVE-2026-8975 Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 1518.8 0.0047 None reported
High CVE-2026-8094 Other issue in the WebRTC component9.8 0.0045 None reported
High CVE-2026-8954 Incorrect boundary conditions, integer overflow in the Audio/Video component7.5 0.0043 None reported
High CVE-2026-8959 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component9.6 0.0042 None reported
High CVE-2026-8092 Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.28.1 0.0041 None reported
High CVE-2026-8947 Use-after-free in the DOM: Bindings (WebIDL) component7.5 0.0041 None reported
High CVE-2026-8968 Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component7.5 0.0041 None reported
High CVE-2026-12327 Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 1528.1 0.0041 None reported
High CVE-2026-12290 Memory safety bug fixed in Thunderbird 1528.1 0.0040 None reported
High CVE-2026-12289 Privilege escalation in the Graphics: WebRender component8.8 0.0040 None reported
High CVE-2026-8955 Privilege escalation in the DOM: Workers component8.8 0.0039 None reported
High CVE-2026-8957 Privilege escalation in the Enterprise Policies component8.8 0.0039 None reported
High CVE-2026-12291 Use-after-free in the Networking: HTTP component8.8 0.0038 None reported
Showing 1 to 25 of 56 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.