---
id: CVE-2026-92238
title: >-
  A maliciously constructed mail header could lead to multiple fields being
  parsed as one, or potential memory safety violations
summary: >-
  A maliciously constructed mail header could lead to multiple fields being
  parsed as one, or potential memory safety violations. This vulnerability was
  fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-444
  - CWE-843
vendor: mozilla
product: thunderbird
affected:
  - thunderbird < 140.16.0
  - 'thunderbird >= 141.0, < 153.3.0'
  - 'thunderbird >= 154.0, < 156.0'
patched:
  - thunderbird 156.0
published: '2026-09-15'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:15:49.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92238'
references:
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2060601'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-94/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-95/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-96/'
    label: security@mozilla.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92238.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92238'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2534199'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92238'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92238'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92238'
  - url: 'https://access.redhat.com/errata/RHSA-2026:70642'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73130'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73971'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00539
epssPercentile: 0.45155
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-22T18:43:18.822790Z'
scores:
  nvd: 9.8
  vendor: 6.1
  adp: 9.8
ingestedAt: '2026-09-15T20:44:02.608Z'
---

## Overview

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

## Affected

- `thunderbird < 140.16.0`
- `thunderbird >= 141.0, < 153.3.0`
- `thunderbird >= 154.0, < 156.0`

## Remediation

Upgrade past the affected range:

- `thunderbird 156.0`

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-09-30 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92238.json)
- **RHSA-2026:70642** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:70642)
- **RHSA-2026:73130** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:73130)
- **RHSA-2026:73971** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73971)