DSA-6418-1 thunderbird - security update
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6418-1
CSIRTS triage
- What
- Multiple security issues in Thunderbird could result in arbitrary code execution.
- Who is affected
- All users running affected versions of Thunderbird.
- Urgency
- Critical due to confirmed arbitrary code execution vulnerabilities.
- Action
- Apply Debian security update DSA-6418-1 to Thunderbird immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Thunderbird
Get an email when a new Thunderbird advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00329.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-148990.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-157180.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-157190.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163490.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163500.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163510.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163520.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163530.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163540.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-163550.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Mozilla Firefox and Firefox ESR: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] Mozilla Thunderbird: Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] Mozilla Firefox: Multiple vulnerabilities allow unspecified attackcert-bund
- unknownMultiple vulnerabilities in Mozilla Thunderbird (July 23, 2026)cert-fr-avis
- highCVE-2026-14899: The code to parse MIME headers for display when forwarding a message (if the setting to view a…nvd
- unknownMozilla Products Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in Mozilla products (July 22, 2026)cert-fr-avis
- unknownDSA-6394-1 firefox-esr - security updatedebian
- criticalCVE-2026-16412: Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed ev…nvd
- highCVE-2026-16405: Information disclosure in the Networking: WebSockets component. This vulnerability was fixed i…nvd
- highCVE-2026-16396: Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ES…nvd
- highCVE-2026-16391: Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Fi…nvd
More from Debian Security Advisories
- unknownDSA-6464-1 erlang - security update2026-08-25
- unknownDSA-6465-1 openssl - security update2026-08-25
- unknownDSA-6466-1 linux - security update2026-08-25
- unknownDSA-6462-1 zfs-linux - security update2026-08-24
- unknownDSA-6463-1 webkit2gtk - security update2026-08-24