CVE-2026-113869

MEDIUM 5.4

Use-after-free in S/MIME decryption during a security device password prompt

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.

Vendor	mozilla
Product	thunderbird
Ecosystems	Browser JavaScript
Industries	Technology
Published	Oct 20, 2026
Last Updated	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for mozilla thunderbird

Be the first to know when new medium vulnerabilities affecting mozilla thunderbird are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Thunderbird

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=2075530 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-114/

Credits

Stefan Tatschner