---
id: CVE-2026-92238
title: >-
  A maliciously constructed mail header could lead to multiple fields being
  parsed as one, or potential memory safety violations
summary: >-
  A maliciously constructed mail header could lead to multiple fields being
  parsed as one, or potential memory safety violations. This vulnerability was
  fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
severity: medium
vendor: Mozilla
product: Thunderbird
affected:
  - Thunderbird
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:34:05.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92238'
references:
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2060601'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-94/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-95/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-96/'
    label: security@mozilla.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92238.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92238'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2534199'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92238'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92238'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92238'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-15T20:44:02.608Z'
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-843
epss: 0.00181
epssPercentile: 0.07899
---

## Overview

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92238.json)