Mozilla Thunderbird ESR (tr) 140.1.1
Mozilla Thunderbird ESR (tr) 140.1.1, released August 5, 2025, fixes 32 CVEs in Mozilla Thunderbird ESR (tr). None of them is reported as exploited. Patch Radar priority: High. The latest Mozilla Thunderbird ESR (tr) is 153.7.0, which also fixes every one of these CVEs.
Superseded. The latest Mozilla Thunderbird ESR (tr) is 153.7.0, which also fixes every CVE on this page. Install that instead.
Priority of the 32 CVEs
Applies to
| Product | Version |
|---|---|
| Mozilla Thunderbird ESR (tr) | 140.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2025-0247 | Memory safety bugs fixed in Firefox 134 and Thunderbird 134 | 9.8 | 0.1070 | None reported |
| High | CVE-2025-6436 | Memory safety bugs fixed in Firefox 140 and Thunderbird 140 | 8.1 | 0.0426 | None reported |
| High | CVE-2024-11705 | Mozilla Firefox ESR and 8 others: NULL Pointer Dereference | 9.1 | 0.0066 | None reported |
| High | CVE-2025-1011 | A bug in WebAssembly code generation could result in a crash | 8.8 | 0.0063 | None reported |
| High | CVE-2024-11702 | Mozilla Firefox ESR and 8 others: Inappropriate Encoding for Output Context | 7.5 | 0.0053 | None reported |
| High | CVE-2024-11700 | Mozilla Firefox ESR and 8 others: Improper Restriction of Rendered UI Layers or Frames | 8.1 | 0.0051 | None reported |
| High | CVE-2025-4091 | Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 | 8.8 | 0.0051 | None reported |
| High | CVE-2025-1942 | Disclosure of uninitialized memory when .toUpperCase() causes string to get longer | 9.8 | 0.0048 | None reported |
| High | CVE-2025-3034 | Memory safety bugs fixed in Firefox 137 and Thunderbird 137 | 8.1 | 0.0048 | None reported |
| High | CVE-2025-5262 | Mozilla Thunderbird ESR and 2 others: Double Free | 7.5 | 0.0046 | None reported |
| High | CVE-2025-4083 | Process isolation bypass using "javascript:" URI links in cross-origin frames | 9.1 | 0.0046 | None reported |
| High | CVE-2025-6435 | Save as in Devtools could download files without sanitizing the extension | 8.1 | 0.0046 | None reported |
| High | CVE-2025-1012 | Use-after-free during concurrent delazification | 8.8 | 0.0045 | None reported |
| High | CVE-2024-9403 | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 7.5 | 0.0045 | None reported |
| High | CVE-2025-1943 | Memory safety bugs fixed in Firefox 136 and Thunderbird 136 | 8.2 | 0.0044 | None reported |
| High | CVE-2025-3032 | Leaking file descriptors from the fork server | 7.4 | 0.0041 | None reported |
| High | CVE-2025-1930 | AudioIPC StreamData could trigger a use-after-free in the Browser process | 8.8 | 0.0040 | None reported |
| High | CVE-2025-5272 | Memory safety bugs fixed in Firefox 139 and Thunderbird 139 | 7.3 | 0.0034 | None reported |
| High | CVE-2025-4087 | Unsafe attribute access during XPath parsing | 8.8 | 0.0032 | None reported |
| High | CVE-2025-4085 | Potential information leakage and privilege escalation in UITour actor | 7.1 | 0.0031 | None reported |
| High | CVE-2025-3033 | Opening local .url files could lead to another file being opened | 7.7 | 0.0017 | None reported |
| Routine | CVE-2024-11706 | Mozilla Firefox ESR and 8 others: NULL Pointer Dereference | 6.5 | 0.0050 | None reported |
| Routine | CVE-2025-4082 | WebGL shader attribute memory corruption in Thunderbird for macOS | 5.9 | 0.0046 | None reported |
| Routine | CVE-2024-11701 | Mozilla Firefox ESR and 8 others: Authentication Bypass by Spoofing | 4.3 | 0.0042 | None reported |
| Routine | CVE-2024-10468 | Mozilla Firefox ESR and 7 others: Allocation of Resources Without Limits or Throttling | 5.3 | 0.0042 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.