CVE-2026-113869: Thunderbird Use-After-Free Vulnerability

CVE-2026-113869 Overview

CVE-2026-113869 is a use-after-free vulnerability in Mozilla Thunderbird's S/MIME message decryption workflow. When Thunderbird prompts for a security device password, such as a smartcard PIN or the Primary Password, the message load can finish or be cancelled while the prompt remains open. This condition frees the message decoder while it is still in use, producing a potentially exploitable crash. The flaw is tracked as [CWE-416] Use After Free and was fixed in Thunderbird 158.0.1.

Critical Impact
An attacker who delivers a crafted S/MIME message can trigger memory corruption in Thunderbird when the user interacts with a security device password prompt, leading to a potentially exploitable crash.

Affected Products

Mozilla Thunderbird versions prior to 158.0.1
Thunderbird deployments using S/MIME with smartcards or Primary Password
Thunderbird clients configured with PKCS#11 security devices

Discovery Timeline

2026-10-20 - CVE-2026-113869 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113869

Vulnerability Analysis

The vulnerability resides in Thunderbird's S/MIME decryption pipeline. When a user opens an encrypted S/MIME message, Thunderbird invokes the NSS layer to decrypt the content. If the private key is held on a protected security device, NSS triggers a modal password or PIN prompt. During this prompt, the enclosing message load can complete or be cancelled by the user or by application state changes. The message decoder object is released while the prompt callback still holds a reference, producing a dangling pointer. Subsequent operations on the freed decoder result in a use-after-free. See Mozilla Security Advisory MFSA 2026-114 for vendor details.

Root Cause

The root cause is improper lifetime management of the S/MIME message decoder across an asynchronous user interaction boundary. The decoder is not retained for the full duration of the password prompt, allowing deallocation while an outstanding reference remains active. This matches the [CWE-416] Use After Free pattern.

Attack Vector

Exploitation requires a victim to open or preview an attacker-supplied encrypted S/MIME message and to be prompted for a security device password. The attacker needs valid credentials against a target recipient to send the crafted message, consistent with the required-privilege characteristic noted in the advisory. No code is provided here; refer to Mozilla Bug Report #2075530 for upstream analysis.

// No verified exploitation code is published for CVE-2026-113869.
// See MFSA 2026-114 and Bugzilla #2075530 for technical details.

Detection Methods for CVE-2026-113869

Indicators of Compromise

Unexpected Thunderbird process crashes correlated with opening S/MIME encrypted messages
Crash telemetry referencing the S/MIME decoder or NSS PK11 password callback paths
Repeated inbound encrypted messages from unknown senders targeting users with smartcard or Primary Password configurations

Detection Strategies

Inventory installed Thunderbird versions across the fleet and flag any build earlier than 158.0.1
Monitor endpoint crash reports for Thunderbird faults occurring during message rendering or decryption
Correlate mail gateway logs for encrypted S/MIME messages delivered to users with hardware token authentication

Monitoring Recommendations

Enable application crash logging on endpoints running Thunderbird and forward events to the SIEM
Alert on Thunderbird process termination events immediately following a PKCS#11 prompt
Track software inventory changes to confirm Thunderbird upgrades to 158.0.1 or later

How to Mitigate CVE-2026-113869

Immediate Actions Required

Upgrade all Thunderbird installations to version 158.0.1 or later
Prioritize endpoints that use S/MIME with smartcards, HSMs, or a Primary Password
Advise users to cancel and discard unexpected password prompts triggered by unsolicited encrypted mail

Patch Information

Mozilla fixed the issue in Thunderbird 158.0.1. The patch adjusts the message decoder lifetime so that the object remains valid for the duration of the security device password prompt. Reference Mozilla Security Advisory MFSA 2026-114 and Mozilla Bug Report #2075530 for full remediation details.

Workarounds

Disable automatic message preview for untrusted folders to reduce exposure before patching
Restrict S/MIME certificate acceptance to known internal and partner issuers
Where feasible, temporarily disable Primary Password or smartcard-backed S/MIME decryption until the upgrade is deployed

bash

# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Example: query package version via rpm or dpkg
rpm -q thunderbird || dpkg -l | grep thunderbird