Critical Security Update for Thunderbird: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:9638: Important: thunderbird security update. Affects thunderbird versions < 140.9.1-1.el10_1.alma.1. Fixed in 140.9.1-1.el10_1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a widely used standalone mail and newsgroup client known for its robust features, including email management, customizable interface, and support for various protocols. However, it has recently been identified as vulnerable to several security issues that could potentially compromise user data and system integrity.
Vulnerability Detail
The vulnerabilities stem from issues in the libpng library and memory safety bugs in Thunderbird and Firefox. Specifically, a use-after-free vulnerability (CVE-2026-33416) could allow arbitrary code execution, while an out-of-bounds read/write vulnerability (CVE-2026-33636) could lead to information disclosure and denial of service. Additionally, memory safety bugs (CVE-2026-5734, CVE-2026-5731) and an integer overflow in the Graphics: Text component (CVE-2026-5732) further exacerbate the risk, potentially allowing attackers to exploit these flaws for malicious purposes.
How To Fix
Minimum fixed version
140.9.1-1.el10_1.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted emails or attachments until the update is applied. Additionally, consider disabling any unnecessary plugins that may interact with email content.
Conclusion
The recent vulnerabilities in Thunderbird highlight the importance of keeping software updated to protect against potential exploits. Users are strongly encouraged to apply the latest security updates to mitigate risks associated with these vulnerabilities.
See every vulnerability recorded for thunderbird →
FAQ
The vulnerabilities include arbitrary code execution, information disclosure, and memory safety issues that could be exploited by attackers.
You can verify your version of Thunderbird by navigating to the 'Help' menu and selecting 'About Thunderbird'.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json.
If an immediate update is not possible, avoid opening suspicious emails and consider disabling plugins that may pose additional risks.
Detailed information can be found on the CVE pages linked in the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
