Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113867 Overview
CVE-2026-113867 affects Mozilla Thunderbird's chat feature when configured with Extensible Messaging and Presence Protocol (XMPP) accounts. Thunderbird failed to escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could inject arbitrary stanzas into the victim's connection. The server then processed those stanzas as if the user sent them. Mozilla fixed the issue in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Critical Impact
A remote XMPP peer can send messages or alter contact and subscription settings on behalf of the victim with no user interaction.
Affected Products
- Mozilla Thunderbird versions prior to 158.0.1
- Mozilla Thunderbird versions prior to 153.5.1
- Thunderbird chat feature with XMPP accounts enabled
Discovery Timeline
- 2026-10-20 - CVE-2026-113867 published to the National Vulnerability Database (NVD)
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-113867
Vulnerability Analysis
The flaw is an injection vulnerability in Thunderbird's XMPP stanza serializer. XMPP exchanges structured XML fragments called stanzas between clients and servers. When Thunderbird constructed outgoing stanzas, it did not escape attribute values that originated from inbound requests. An attacker who could send messages to the targeted account could embed stanza delimiters inside attribute values. When Thunderbird composed an automatic reply, those delimiters broke out of the intended attribute and introduced attacker-controlled XML into the stream.
The XMPP server then parsed and routed the injected stanzas as legitimate traffic from the authenticated user. This allowed the attacker to issue arbitrary protocol operations under the victim's identity, including sending chat messages, modifying roster entries, and changing presence subscription state. No user prompt, click, or confirmation was required.
Root Cause
The root cause is missing output encoding during XML serialization. Attribute values pulled from incoming XMPP requests were concatenated into outgoing stanzas without escaping characters such as ", ', <, >, and &. This classifies as improper neutralization of special elements in output, similar to [CWE-91] XML Injection.
Attack Vector
Exploitation requires the victim to use Thunderbird's chat feature with an XMPP account. A remote XMPP user sends a crafted stanza whose attribute values contain XML metacharacters and additional stanza fragments. Thunderbird's automatic reply logic echoes the hostile attribute value back into a new stanza, where the embedded fragments terminate the current element and introduce attacker-defined stanzas into the client-to-server stream. The server treats the injected stanzas as authentic user actions.
Technical references and vendor-coordinated fixes are documented in the Mozilla Bug Report #2080073, the Mozilla Security Advisory MFSA-2026-114, and the Mozilla Security Advisory MFSA-2026-115.
Detection Methods for CVE-2026-113867
Indicators of Compromise
- Outbound XMPP stanzas from a Thunderbird client containing unexpected <message>, <presence>, or <iq> elements the user did not author.
- Unexplained roster modifications or subscription state changes on the XMPP account.
- Automatic replies whose attribute values contain unescaped XML metacharacters such as ", <, or >.
Detection Strategies
- Inspect XMPP server logs for stanzas originating from a session whose structure deviates from the client's normal patterns.
- Compare outbound chat message volume per user against historical baselines to identify injected messages.
- Alert on roster or subscription changes that occur without a corresponding client-initiated command event.
Monitoring Recommendations
- Enable verbose stanza logging on the XMPP server for accounts tied to Thunderbird clients until all endpoints are patched.
- Monitor Thunderbird client versions across the fleet and flag any version below 158.0.1 or 153.5.1.
- Correlate inbound XMPP messages from untrusted peers with subsequent automatic replies to identify echo-based injection attempts.
How to Mitigate CVE-2026-113867
Immediate Actions Required
- Update Thunderbird to version 158.0.1 or 153.5.1 or later on all endpoints with XMPP chat enabled.
- Audit XMPP accounts for unauthorized roster entries, subscription changes, or outbound messages during the exposure window.
- Rotate credentials for XMPP accounts that received traffic from untrusted peers before patching.
Patch Information
Mozilla addressed the vulnerability in Thunderbird 158.0.1 and Thunderbird 153.5.1. Patch details are published in the Mozilla Security Advisory MFSA-2026-114 and the Mozilla Security Advisory MFSA-2026-115.
Workarounds
- Disable the Thunderbird chat feature until the client is upgraded.
- Remove or disable XMPP accounts configured in Thunderbird on unpatched hosts.
- Restrict XMPP server policy to accept messages only from federated domains and contacts on the user's roster.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
