PT-2026-5077 · Mozilla+2 · Thunderbird+2

Christian Rossow + 3 · Published 2026-01-01 · Updated 2026-03-18 · CVE-2026-0818

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 147.0.1 Thunderbird versions prior to 140.7.1

Description A flaw exists that could allow for CSS-based exfiltration of content from partially encrypted emails when remote content is permitted. This could potentially compromise the confidentiality of email communications.

Recommendations Update Thunderbird to version 147.0.1 or later. Update Thunderbird to version 140.7.1 or later.

Fix

CSRF

Improper Encoding or Escaping of Output

Information Disclosure

Weakness Enumeration

CWE-352

CWE-116

CWE-200

Related Identifiers

BDU:2026-06693

CVE-2026-0818

MGASA-2026-0036

OESA-2026-1468

OESA-2026-1539

OPENSUSE-SU-2026:10128-1

OPENSUSE-SU-2026:20391-1

SUSE-SU-2026:0388-1

USN-7991-1

Affected Products

Linuxmint

Thunderbird

Ubuntu

References · 239

• https://nvd.nist.gov/vuln/detail/CVE-2026-2787 · Security Note
• https://ubuntu.com/security/CVE-2025-9184 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6427 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6433 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9179 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-07 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-0818 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2793 · Security Note
• https://ubuntu.com/security/CVE-2025-9180 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8036 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13019 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13012 · Vendor Advisory