5.4

CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

Awaiting analysis
AliasesDEBIAN-CVE-2026-113470openSUSE-SU-2026:12211-1UBUNTU-CVE-2026-113470
Published 20-10-2026Last modified 21-10-2026

Vulnerability summary

CVE-2026-113470 is a medium (CVSS 5.4) Improper Certificate Validation vulnerability in thunderbird. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.46%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2026:12224-1OPENSUSE-SU-2026:12259-1SUSE-SU-2026:4928-1

Timeline

  1. 20-10-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

21-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu8 products
  • mozjs102All versions (No fix recorded)
  • mozjs115All versions (No fix recorded)
  • mozjs38All versions (No fix recorded)
  • mozjs52All versions (No fix recorded)
  • mozjs68All versions (No fix recorded)
Opensuse3 products
  • firefox-esr&distro=openSUSE Tumbleweed< 153.5.1-1.1
  • mozilla-nss&distro=openSUSE Leap 16.0< 3.125-160000.3.1
  • MozillaFirefox&distro=openSUSE Leap 16.0< 153.5.1-160000.1.1
Debian2 products
  • firefox-esrAll versions (No fix recorded) | < 153.5.1esr-1~deb12u1 | < 153.5.1esr-1~deb13u1 | < 153.5.1esr-1
  • thunderbirdAll versions (No fix recorded) | < 1:153.5.1esr-1~deb12u1 | < 1:153.5.1esr-1~deb13u1
Mageia2 products
  • nss< 3.131.1-1.mga10
  • rootcerts< 20261020.00-1.mga10
Suse1 product
  • mozilla-nss&distro=SUSE Linux Micro 6.2< 3.125-160000.3.1

5 vendors · 16 products

References

29 links
Show all 29 references