---
id: CVE-2026-16412
title: Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
summary: >-
  Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some
  of these bugs showed evidence of memory corruption and we presume that with
  enough effort some of these could have been exploited to run arbitrary code.
  This …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
vendor: Mozilla
product: Firefox
affected:
  - Firefox
  - Thunderbird
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-23T00:00:00+00:00'
published: '2026-07-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T13:49:57.535Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16412'
references:
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2005113%2C2025369%2C2026301%2C2028663%2C2029761%2C2042242%2C2043271%2C2043300%2C2044612%2C2045378%2C2045406%2C2045407%2C2045616%2C2045626%2C2045730%2C2045732%2C2045769%2C2045771%2C2047957%2C2048934%2C2049818%2C2049822%2C2050151%2C2050368%2C2051653%2C2051658
    label: >-
      Moderate-severity memory safety bugs fixed in Thunderbird ESR 140.13 and
      Thunderbird 153
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043035%2C2045057%2C2045187%2C2045402%2C2045417%2C2045482%2C2045611%2C2045618%2C2045756%2C2046917%2C2047718
    label: >-
      High-severity memory safety bugs fixed in Thunderbird ESR 140.13 and
      Thunderbird 153
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045413%2C2053635%2C2053637
    label: >-
      Low-severity memory safety bugs fixed in Thunderbird ESR 140.13 and
      Thunderbird 153
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-68/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-70/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-71/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-72/'
tags:
  - cve.org
epss: 0.00521
epssPercentile: 0.43062
ingestedAt: '2026-10-21T13:57:01.110Z'
---

## Overview

Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

## Affected

- `Firefox`
- `Thunderbird`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.