Skip to main content

Thunderbird CVE-2026-2771

CRITICAL
Out-of-bounds Read (CWE-125)
2026-02-24 security@mozilla.org
Buffer Overflow Information Disclosure Mozilla Thunderbird
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious HTML/DOM
  2. Exploit
    Trigger undefined behavior in parser
  3. Execution
    Achieve arbitrary code execution
  4. Impact
    Compromise browser process with full privileges

Vulnerability Assessment

Weakness
CWE
CWE-125
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions — remote unauthenticated exploitation against default Firefox or Thunderbird installations versions below 148/140.8 via HTML content delivery.
Impact

CVSS 9.8. DOM Core UB can result in exploitable memory corruption.
Exploit ScenarioDerived

Crafted HTML triggers undefined behavior in DOM processing, leading to memory corruption.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Undefined behavior in Firefox DOM Core & HTML component before 148. Can lead to memory corruption and potential code execution.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 9.8

Undefined behavior in Firefox DOM Core.

RemediationAI

Update Firefox to 148+.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-125 OOB read from undefined behavior in DOM Core & HTML processing.

Know when Thunderbird gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 10, 2026 - 08:30 nvd
Patch available
CVE Published
Feb 24, 2026 - 14:16 nvd
CRITICAL 9.8

DescriptionNVD

Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

Executive ViewAI

Why It Matters

A critical vulnerability (CVSS 9.8) in Firefox and Thunderbird DOM processing allows attackers to execute arbitrary code on affected systems. Organizations using these browsers for business operations face immediate risk of data theft, system compromise, and potential lateral movement within the network.

Business Impact: Severe
Compensating Controls

Patch not yet available—implement interim mitigations: (1) Disable JavaScript in Firefox/Thunderbird if business operations permit, or restrict to whitelisted sites only; (2) Deploy network segmentation to limit browser access to essential services; (3) Implement application whitelisting to prevent unauthorized code execution; (4) Block access to known malicious domains via DNS/proxy filtering; (5) Enforce multi-factor authentication on critical systems; (6) Monitor for suspicious DOM-related processes and network activity; (7) Consider restricting Firefox/Thunderbird usage to isolated systems until patch availability.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)NVD

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

More in Thunderbird

View all
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.61 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.27 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.52 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.63 Container suse/sl-micro/6.0/toolbox:13.2-9.16 Image SL-Micro Affected
Image SL-Micro-BYOS-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
SUSE Liberty Linux 8 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:3338 ADVISORY https://access.redhat.com/errata/RHSA-2026:3339 ADVISORY https://access.redhat.com/errata/RHSA-2026:3361 ADVISORY https://access.redhat.com/errata/RHSA-2026:3491 ADVISORY https://access.redhat.com/errata/RHSA-2026:3492 ADVISORY https://access.redhat.com/errata/RHSA-2026:3493 ADVISORY https://access.redhat.com/errata/RHSA-2026:3494 ADVISORY https://access.redhat.com/errata/RHSA-2026:3495 ADVISORY https://access.redhat.com/errata/RHSA-2026:3496 ADVISORY https://access.redhat.com/errata/RHSA-2026:3497 ADVISORY https://access.redhat.com/errata/RHSA-2026:3515 ADVISORY https://access.redhat.com/errata/RHSA-2026:3516 ADVISORY https://access.redhat.com/errata/RHSA-2026:3517 ADVISORY https://access.redhat.com/errata/RHSA-2026:3976 ADVISORY https://access.redhat.com/errata/RHSA-2026:3978 ADVISORY https://access.redhat.com/errata/RHSA-2026:3979 ADVISORY https://access.redhat.com/errata/RHSA-2026:3980 ADVISORY https://access.redhat.com/errata/RHSA-2026:3981 ADVISORY https://access.redhat.com/errata/RHSA-2026:3982 ADVISORY https://access.redhat.com/errata/RHSA-2026:3983 ADVISORY https://access.redhat.com/errata/RHSA-2026:3984 ADVISORY https://access.redhat.com/errata/RHSA-2026:4022 ADVISORY https://access.redhat.com/errata/RHSA-2026:4152 ADVISORY https://access.redhat.com/errata/RHSA-2026:4260 ADVISORY https://access.redhat.com/errata/RHSA-2026:4432 ADVISORY https://vuldb.com/vuln/347562 ADVISORY https://www.mozilla.org/security/advisories/mfsa2026-13/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2026-14/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2026-15/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2026-16/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2026-17/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0812/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0871/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0880/ REF https://access.redhat.com/security/cve/CVE-2026-2771 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2014593 REF https://bugzilla.redhat.com/show_bug.cgi?id=2442288 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2771.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy