Mozilla Thunderbird CVE-2026-113867

Exploitation requires the victim to be running Thunderbird's chat feature with an XMPP account configured and actively connected - standard email-only use of Thunderbird is not affected. The attacker must be a remote XMPP user able to send requests that reach the victim's client (e.g., able to address the victim over the XMPP network). The flaw triggers through Thunderbird's automatic replies, which echo incoming attribute values back into outgoing stanzas without escaping; no user interaction is required (UI:N). The limiting factors are therefore the niche XMPP-chat deployment mode and reachability over XMPP, not any default internet-facing service. The only complete fix stated by the vendor is updating to Thunderbird 158.0.1.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a maximally accessible flaw: remote, low-complexity, no privileges, and explicitly no user interaction, which is why it scores 9.1 with C:H/I:H. The vuln.today decision label is act_now, signaling high prioritization. However, these signals conflict with the empirical exploitation signals: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code or PoC reference appears in the input - only vendor and aggregator advisories. The gap between a 9.1 'act_now' rating and a bottom-decile EPSS is explained by the narrow precondition: the bug only affects Thunderbird's chat feature when an XMPP account is configured and connected, a configuration used by a small minority of Thunderbird's large install base. This is therefore a genuinely high-severity flaw within its feature scope (zero-interaction account takeover of XMPP actions) rather than a broadly wormable internet-facing issue. Note the act_now label and the low EPSS disagree; the act_now rating should be read as 'patch promptly because exploitation needs no interaction,' not as evidence of widespread active exploitation. Authentication is unauthenticated per PR:N, though the attacker must be a remote XMPP party able to reach the victim's client.

A remote XMPP user sends the victim's Thunderbird client a crafted request containing malicious attribute values. Because Thunderbird echoes those values back in an automatic reply without escaping them when serializing the outgoing stanza, the attacker's content breaks out of the attribute context and injects arbitrary XMPP stanzas that the server processes as if the victim sent them - all with no user interaction, letting the attacker send messages or alter the victim's contact and subscription settings. No public exploit code or PoC reference is present in the supplied data.