Live › vulnerability › CVE-2026-113869
Go to dashboardWhen Thunderbird asks for a security device password (such as a smartcard PIN or Primary Password) while decrypting an S/MIME message, cancelling or finishing the load frees the message decoder while it is still in use. The resulting use-after-free can crash Thunderbird in a way that may be exploitable for code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users of Thunderbird who read S/MIME encrypted mail and use a smartcard or a Primary Password that prompts during decryption. Installations that do not use S/MIME or a security device prompt are not in the described trigger path. The sources do not say whether the crash is reachable from a remote message without user action.
No product ranges from the sources yet.
thunderbird --version (or check Help > About Thunderbird) and compare against the fixed release 158.0.1.158.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-113869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.