CVE-2026-3889
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 24, 2026
CISA due date
—
The record
Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 15.6 | MozillaThunderbird | 0 | 140.9.0-150200.8.263.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.9.0-1.1 |
Related vulnerabilities
- CVE-2026-4371 A malicious mail server could send malformed strings with negative lengths, causing the… Also affects MozillaThunderbird
- CVE-2026-4716 Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. Also affects MozillaThunderbird
- CVE-2026-4718 Undefined behavior in the WebRTC: Signaling component. Also affects MozillaThunderbird
- CVE-2026-4713 Incorrect boundary conditions in the Graphics component. Also affects MozillaThunderbird
- CVE-2026-4714 Incorrect boundary conditions in the Audio/Video component. Also affects MozillaThunderbird
- CVE-2026-4717 Privilege escalation in the Netmonitor component. Also affects MozillaThunderbird
- CVE-2026-4711 Use-after-free in the Widget: Cocoa component. Also affects MozillaThunderbird
- CVE-2026-4720 Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and… Also affects MozillaThunderbird