CVE-2026-92238CWE-444

CVE-2026-92238

Critical · published September 16, 2026

CVSS v3.1

9.8

EPSS

Percentile

44.5

In the wild

Unconfirmed

What it is

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00539 · 44.5th percentile
Weakness: CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published: 2026-09-16T00:19Z

Affected products (3)

Product	Versions	Fixed in
mozilla/thunderbird	< 140.16.0	140.16.0
mozilla/thunderbird	≥ 141.0, < 153.3.0	153.3.0
mozilla/thunderbird	≥ 154.0, < 156.0	156.0

References (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=2060601 · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-94/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-95/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-96/ · [email protected]

EPSS history

Timeline

17 SEP 03:33Z
EPSS moved — → 0%
epss
15 SEP 19:42Z
Ambiguous parsing of mail headers
cvelistv5