by Kastro
Paper/Archive/CVE-2026-84143

CVE-2026-84143

Mozilla Firefox — Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.8.318 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory140.15CNA
Thunderbirdsee advisory140.15CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/buglist.cgi?bug_id=2048793%2C2054645%2C2057114%2C2059109%2C2061287refbugzilla.mozilla.org/buglist.cgi?bug_id=2054631%2C2054657%2C2055007%2C2055681%2C2057107%2C2058087%2C2058088%2C2058090%2C2058095%2C2058101%2C2059183%2C2059185%2C2061301%2C2061325refbugzilla.mozilla.org/show_bug.cgi?id=2057108refmozilla.org/security/advisories/mfsa2026-82refmozilla.org/security/advisories/mfsa2026-84refmozilla.org/security/advisories/mfsa2026-85refmozilla.org/security/advisories/mfsa2026-86refmozilla.org/security/advisories/mfsa2026-87refmozilla.org/security/advisories/mfsa2026-88