CVE-2025-4082
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. This bug only affects Thunderbird for macOS. Fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.
Risk Assessment
An attacker could exploit this vulnerability for privilege escalation, potentially leading to system compromise. The risk mainly affects Thunderbird users on macOS.
Recommendation
Update Thunderbird to version 138 or 128.10 (or later). For other Mozilla products, also update to the specified versions.
Other vulnerabilities in Thunderbird
See all- CVE-2026-92240Critical
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication.
- CVE-2026-92238Critical
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-84639Critical
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84637Critical
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.
- CVE-2026-84143Critical
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84142Critical
Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
- CVE-2026-74990Critical
Internally found bugs in Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- CVE-2026-74989Critical
Internally found bugs in Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154 and Thunderbird 154.
- CVE-2026-74988Critical
Internally found bugs in Thunderbird ESR 153.0 and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- CVE-2026-74987Critical
Internally found bugs in Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Original NVD description (English source)
Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS