Mozilla Thunderbird CVE-2026-113869

Exploitation requires a specific, non-default configuration: the victim must have a security device password configured - a smartcard/PIN or a Thunderbird Primary Password - so that a password prompt is triggered during S/MIME decryption. The victim must then open an attacker-supplied S/MIME-encrypted message, AND a timing race must be won whereby the message load finishes or is cancelled while the password prompt is still displayed. Limiting factors that reduce real-world risk: users without a Primary Password or smartcard are not exposed; exploitation depends on user interaction (opening the message and the prompt being open) and on winning a non-deterministic race, and the described outcome is a crash that is only 'potentially' escalatable. Fixed in Thunderbird 158.0.1.

This is a moderate-severity memory-safety issue (CWE-416 use-after-free) in Thunderbird's S/MIME decryption path, and the aggregated signals are internally consistent in pointing to LOW real-world risk. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing and no POC in the provided data, matching the CISA SSVC decision of Exploitation: none, Automatable: no, Technical Impact: partial. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, 5.4) is questionable against the description: the flaw only manifests during a race between a security-device password prompt (smartcard PIN or Primary Password) and message load completion/cancellation, which realistically implies both non-trivial timing (argues for AC:H, not AC:L) and victim interaction with that prompt (argues for UI:R, not UI:N). The PR:L in the vendor vector also appears to model the victim's own configured credential rather than attacker privilege. Net: a crafted/opened S/MIME message can crash Thunderbird and is described by Mozilla as 'potentially exploitable,' but reliable exploitation hinges on winning a UI-driven race, so this is a genuine fix-on-cycle issue rather than an emergency. Conflict to note explicitly: vendor CVSS implies trivial, no-interaction network exploitation (AC:L/UI:N), but the description implies a timing race requiring an open password prompt - verify severity assumptions with the Mozilla advisory (MFSA2026-114).

An attacker sends an S/MIME-encrypted email to a Thunderbird user who protects their private key with a smartcard PIN or Primary Password. When the victim opens the message, Thunderbird displays the password prompt; if the message load completes or is cancelled while that prompt is still open, the decoder is freed while still in use, triggering a use-after-free crash. No public POC is known, and weaponizing the resulting crash into code execution would require winning the timing race reliably.