Linux · Security advisory · May 19, 2026
RHSA-2026:26539: thunderbird security update
RHSA-2026:26539, released May 19, 2026, fixes 22 CVEs in thunderbird (version 140.11.0-1.el10_0). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
22
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0061
49th percentile
Priority of the 22 CVEs
Patch now 0
Urgent 0
High 22
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | RHEL 10 | 140.11.0-1.el10_0 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-8956 | Integer overflow in the Networking: JAR component | 9.8 | 0.0061 | None reported | |
| High | CVE-2026-8946 | Incorrect boundary conditions in the Audio/Video: Web Codecs component | 7.5 | 0.0056 | None reported | |
| High | CVE-2026-8953 | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.6 | 0.0053 | None reported | |
| High | CVE-2026-8975 | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 | 8.8 | 0.0047 | None reported | |
| High | CVE-2026-8094 | Other issue in the WebRTC component | 9.8 | 0.0045 | None reported | |
| High | CVE-2026-8954 | Incorrect boundary conditions, integer overflow in the Audio/Video component | 7.5 | 0.0043 | None reported | |
| High | CVE-2026-8959 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 9.6 | 0.0042 | None reported | |
| High | CVE-2026-8092 | Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2 | 8.1 | 0.0041 | None reported | |
| High | CVE-2026-8947 | Use-after-free in the DOM: Bindings (WebIDL) component | 7.5 | 0.0041 | None reported | |
| High | CVE-2026-8968 | Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component | 7.5 | 0.0041 | None reported | |
| High | CVE-2026-8955 | Privilege escalation in the DOM: Workers component | 8.8 | 0.0039 | None reported | |
| High | CVE-2026-8957 | Privilege escalation in the Enterprise Policies component | 8.8 | 0.0039 | None reported | |
| High | CVE-2026-8962 | Mitigation bypass in the DOM: Security component | 8.1 | 0.0037 | None reported | |
| High | CVE-2026-8974 | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 | 8.8 | 0.0037 | None reported | |
| High | CVE-2026-8958 | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 8.6 | 0.0034 | None reported | |
| High | CVE-2026-8961 | Spoofing issue in the Form Autofill component | 7.5 | 0.0032 | None reported | |
| High | CVE-2026-8090 | Use-after-free in the DOM: Networking component | 7.5 | 0.0032 | None reported | |
| High | CVE-2026-8401 | Sandbox escape in the Profile Backup component | 9.8 | 0.0031 | None reported | |
| High | CVE-2026-8970 | Privilege escalation in the Security component | 8.8 | 0.0031 | None reported | |
| High | CVE-2026-8391 | Other issue in the JavaScript Engine component | 7.5 | 0.0030 | None reported | |
| High | CVE-2026-8388 | Incorrect boundary conditions in the JavaScript Engine: JIT component | 7.5 | 0.0024 | None reported | |
| High | CVE-2026-8950 | Same-origin policy bypass in the Networking: HTTP component | 9.3 | 0.0019 | None reported |
Showing 1 to 22 of 22
1