MGASA-2026-0388: thunderbird Mageia

CVSS: UnknownPublished
Published 09-09-2026Last modified 09-09-2026
Open JSON

Vulnerability summary

MGASA-2026-0388 is a vulnerability in thunderbird Mageia with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 31 · Downstream 0
CVE-2026-16365CVE-2026-16371CVE-2026-74952CVE-2026-75874CVE-2026-84118CVE-2026-84119

Timeline

  1. 09-09-2026
    PublishedVulnerability first disclosed.
  2. 09-09-2026
    Last modifiedVulnerability information updated.

Description

Updated thunderbird packages fix security vulnerabilities Uninitialized memory in MIME parsing. (CVE-2026-84639) One byte overflow read in mail parser. (CVE-2026-84640) Information disclosure due to malicious IMAP server response. (CVE-2026-84641) Calendar invitation attachments could launch local executables. (CVE-2026-84637) Allowed UNC hostnames for attachments interpreted as a regular expression. (CVE-2026-84642) Sandbox escape in the Remote Settings Client component. (CVE-2026-75874) Privilege escalation in the DOM: Workers component. (CVE-2026-16365) Use-after-free in the JavaScript: GC component. (CVE-2026-84118) Sandbox escape due to use-after-free in the DOM: Navigation component. (CVE-2026-84119) Use-after-free in the Audio/Video component. (CVE-2026-84120) Sandbox escape due to use-after-free in the DOM: Security component. (CVE-2026-84121) Use-after-free in the Audio/Video component. (CVE-2026-84122) Privilege escalation due to use-after-free in the Graphics: WebGPU component. (CVE-2026-84123) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125) Privilege escalation in the DOM: Navigation component. (CVE-2026-16371) Privilege escalation in the Application Update component. (CVE-2026-74952) Site isolation issue in the DOM: Navigation component. (CVE-2026-84129) Information disclosure in the Graphics: WebGPU component. (CVE-2026-84130) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-84131) Information disclosure in the Networking: HTTP component. (CVE-2026-84132) Site isolation issue in the DOM: Push Subscriptions component. (CVE-2026-84133) Other issue in the Profile Backup component. (CVE-2026-84134) Other issue in the DOM: Navigation component. (CVE-2026-84136) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137) Clickjacking issue in the DOM: Events component. (CVE-2026-84139) Site isolation issue in the DOM: Navigation component. (CVE-2026-84140) Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84143) Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2. (CVE-2026-84144) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84145)

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Mageia4 products
  • thunderbird< 153.2.0-1.mga10
  • thunderbird-l10n< 153.2.0-1.mga10
  • thunderbird< 140.15.0-1.mga9
  • thunderbird-l10n< 140.15.0-1.mga9

1 vendor · 4 products

References

8 links