Quick answers
- Is CVE-2026-92238 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92238 being exploited in the wild.
- How severe is CVE-2026-92238?
- Critical severity, with a CVSS score of 9.8, published 15 September 2026.
- Which products and versions are affected?
- Mozilla Thunderbird before 140.16, 153.3, or 156.
- Is there a fix for CVE-2026-92238?
- A patch was published on 2026-09-15: Fixed in Thunderbird 156, 140.16, and 153.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92238 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-92238?
- Check whether you run Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-92238 is an ambiguous parsing vulnerability in Thunderbird's mail header parsing logic. A maliciously constructed mail header can cause multiple fields to be incorrectly parsed as a single field, or trigger potential memory safety violations. The attack requires no authentication and can be delivered via email; however, the Mozilla advisory notes that scripting is disabled when reading mail in Thunderbird, which limits the impact compared to browser contexts. The vulnerability is fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected products
- Mozilla Thunderbird before 140.16, 153.3, or 156
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in Thunderbird 156, 140.16, and 153.3