An update for thunderbird is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4410 Final 1.0 1.0 2026-10-16 Initial 2026-10-16 2026-10-16 openEuler SA Tool V1.0 2026-10-16 thunderbird security update An update for thunderbird is now available for openEuler-24.03-LTS-SP4 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100756) Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100757) Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100758) Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100759) Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100762) Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100766) Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100767) Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100769) Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100770) Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100771) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100772) Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100773) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100774) Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100775) Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100776) Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100777) Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100778) Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100779) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100780) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100781) Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100782) Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100783) Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100784) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100785) Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100786) Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100788) Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100789) Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100790) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100791) JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100792) Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100794) Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100797) Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100801) Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100803) Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100807) Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100811) Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100818) Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100819) Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100820) Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100821) Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100832) Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92005) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92006) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92007) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92008) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92009) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92010) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92011) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92012) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92013) Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.(CVE-2026-92014) Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92015) Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92016) Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92017) Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92018) Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92019) Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92020) Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.(CVE-2026-92021) Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92022) Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92023) Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92024) Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92025) Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92026) Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92027) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92028) Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92029) Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92030) Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92031) Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92032) Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-92035) A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92238) A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92239) A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92240) Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-96869) An update for thunderbird is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical thunderbird https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100756 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100757 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100758 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100759 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100762 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100766 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100767 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100769 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100770 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100771 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100772 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100773 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100774 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100775 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100776 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100777 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100778 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100779 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100780 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100781 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100782 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100783 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100784 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100785 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100786 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100788 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100789 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100790 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100791 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100792 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100794 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100797 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100801 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100803 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100807 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100811 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100818 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100819 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100820 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100821 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100832 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92005 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92006 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92007 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92008 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92009 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92010 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92011 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92012 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92013 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92014 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92015 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92016 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92017 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92018 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92019 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92020 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92021 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92022 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92023 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92024 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92025 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92026 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92027 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92028 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92029 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92030 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92031 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92032 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92035 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92238 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92239 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92240 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-96869 https://nvd.nist.gov/vuln/detail/CVE-2026-100756 https://nvd.nist.gov/vuln/detail/CVE-2026-100757 https://nvd.nist.gov/vuln/detail/CVE-2026-100758 https://nvd.nist.gov/vuln/detail/CVE-2026-100759 https://nvd.nist.gov/vuln/detail/CVE-2026-100762 https://nvd.nist.gov/vuln/detail/CVE-2026-100766 https://nvd.nist.gov/vuln/detail/CVE-2026-100767 https://nvd.nist.gov/vuln/detail/CVE-2026-100769 https://nvd.nist.gov/vuln/detail/CVE-2026-100770 https://nvd.nist.gov/vuln/detail/CVE-2026-100771 https://nvd.nist.gov/vuln/detail/CVE-2026-100772 https://nvd.nist.gov/vuln/detail/CVE-2026-100773 https://nvd.nist.gov/vuln/detail/CVE-2026-100774 https://nvd.nist.gov/vuln/detail/CVE-2026-100775 https://nvd.nist.gov/vuln/detail/CVE-2026-100776 https://nvd.nist.gov/vuln/detail/CVE-2026-100777 https://nvd.nist.gov/vuln/detail/CVE-2026-100778 https://nvd.nist.gov/vuln/detail/CVE-2026-100779 https://nvd.nist.gov/vuln/detail/CVE-2026-100780 https://nvd.nist.gov/vuln/detail/CVE-2026-100781 https://nvd.nist.gov/vuln/detail/CVE-2026-100782 https://nvd.nist.gov/vuln/detail/CVE-2026-100783 https://nvd.nist.gov/vuln/detail/CVE-2026-100784 https://nvd.nist.gov/vuln/detail/CVE-2026-100785 https://nvd.nist.gov/vuln/detail/CVE-2026-100786 https://nvd.nist.gov/vuln/detail/CVE-2026-100788 https://nvd.nist.gov/vuln/detail/CVE-2026-100789 https://nvd.nist.gov/vuln/detail/CVE-2026-100790 https://nvd.nist.gov/vuln/detail/CVE-2026-100791 https://nvd.nist.gov/vuln/detail/CVE-2026-100792 https://nvd.nist.gov/vuln/detail/CVE-2026-100794 https://nvd.nist.gov/vuln/detail/CVE-2026-100797 https://nvd.nist.gov/vuln/detail/CVE-2026-100801 https://nvd.nist.gov/vuln/detail/CVE-2026-100803 https://nvd.nist.gov/vuln/detail/CVE-2026-100807 https://nvd.nist.gov/vuln/detail/CVE-2026-100811 https://nvd.nist.gov/vuln/detail/CVE-2026-100818 https://nvd.nist.gov/vuln/detail/CVE-2026-100819 https://nvd.nist.gov/vuln/detail/CVE-2026-100820 https://nvd.nist.gov/vuln/detail/CVE-2026-100821 https://nvd.nist.gov/vuln/detail/CVE-2026-100832 https://nvd.nist.gov/vuln/detail/CVE-2026-92005 https://nvd.nist.gov/vuln/detail/CVE-2026-92006 https://nvd.nist.gov/vuln/detail/CVE-2026-92007 https://nvd.nist.gov/vuln/detail/CVE-2026-92008 https://nvd.nist.gov/vuln/detail/CVE-2026-92009 https://nvd.nist.gov/vuln/detail/CVE-2026-92010 https://nvd.nist.gov/vuln/detail/CVE-2026-92011 https://nvd.nist.gov/vuln/detail/CVE-2026-92012 https://nvd.nist.gov/vuln/detail/CVE-2026-92013 https://nvd.nist.gov/vuln/detail/CVE-2026-92014 https://nvd.nist.gov/vuln/detail/CVE-2026-92015 https://nvd.nist.gov/vuln/detail/CVE-2026-92016 https://nvd.nist.gov/vuln/detail/CVE-2026-92017 https://nvd.nist.gov/vuln/detail/CVE-2026-92018 https://nvd.nist.gov/vuln/detail/CVE-2026-92019 https://nvd.nist.gov/vuln/detail/CVE-2026-92020 https://nvd.nist.gov/vuln/detail/CVE-2026-92021 https://nvd.nist.gov/vuln/detail/CVE-2026-92022 https://nvd.nist.gov/vuln/detail/CVE-2026-92023 https://nvd.nist.gov/vuln/detail/CVE-2026-92024 https://nvd.nist.gov/vuln/detail/CVE-2026-92025 https://nvd.nist.gov/vuln/detail/CVE-2026-92026 https://nvd.nist.gov/vuln/detail/CVE-2026-92027 https://nvd.nist.gov/vuln/detail/CVE-2026-92028 https://nvd.nist.gov/vuln/detail/CVE-2026-92029 https://nvd.nist.gov/vuln/detail/CVE-2026-92030 https://nvd.nist.gov/vuln/detail/CVE-2026-92031 https://nvd.nist.gov/vuln/detail/CVE-2026-92032 https://nvd.nist.gov/vuln/detail/CVE-2026-92035 https://nvd.nist.gov/vuln/detail/CVE-2026-92238 https://nvd.nist.gov/vuln/detail/CVE-2026-92239 https://nvd.nist.gov/vuln/detail/CVE-2026-92240 https://nvd.nist.gov/vuln/detail/CVE-2026-96869 openEuler-24.03-LTS-SP4 thunderbird-140.16.0-1.oe2403sp4.aarch64.rpm thunderbird-debuginfo-140.16.0-1.oe2403sp4.aarch64.rpm thunderbird-debugsource-140.16.0-1.oe2403sp4.aarch64.rpm thunderbird-librnp-rnp-140.16.0-1.oe2403sp4.aarch64.rpm thunderbird-wayland-140.16.0-1.oe2403sp4.aarch64.rpm thunderbird-140.16.0-1.oe2403sp4.src.rpm thunderbird-140.16.0-1.oe2403sp4.x86_64.rpm thunderbird-debuginfo-140.16.0-1.oe2403sp4.x86_64.rpm thunderbird-debugsource-140.16.0-1.oe2403sp4.x86_64.rpm thunderbird-librnp-rnp-140.16.0-1.oe2403sp4.x86_64.rpm thunderbird-wayland-140.16.0-1.oe2403sp4.x86_64.rpm Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100756 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100757 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100758 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100759 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100762 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100766 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100767 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100769 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100770 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100771 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100772 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100773 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100774 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100775 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100776 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100777 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100778 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100779 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100780 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100781 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100782 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100783 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100784 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100785 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100786 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100788 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100789 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100790 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100791 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100792 openEuler-24.03-LTS-SP4 High 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100794 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100797 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100801 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100803 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100807 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100811 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100818 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100819 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100820 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100821 openEuler-24.03-LTS-SP4 Medium 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-100832 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92005 openEuler-24.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92006 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92007 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92008 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92009 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92010 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92011 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92012 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92013 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16. 2026-10-16 CVE-2026-92014 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92015 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92016 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92017 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92018 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92019 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92020 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. 2026-10-16 CVE-2026-92021 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92022 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92023 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92024 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92025 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92026 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92027 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92028 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92029 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92030 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92031 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92032 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17. 2026-10-16 CVE-2026-92035 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92238 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92239 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. 2026-10-16 CVE-2026-92240 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410 Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. 2026-10-16 CVE-2026-96869 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N thunderbird security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410