ALSA-2026:90895: Important: thunderbird security, bug fix, and enhancement update

Q: What must an attacker be able to do to trigger the issue?

They need to cause libexpat to process crafted XML input. The advisory identifies the impact as denial of service.

Q: Does the advisory identify affected package versions or configuration-specific exposure?

No. It does not provide affected or fixed Thunderbird package versions, nor does it state whether any particular configuration, including the default configuration, is affected.

Q: Is a workaround provided for systems that cannot be updated immediately?

No workaround or temporary mitigation is included in the advisory data.

Published Oct 27, 2026

Updated

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

libexpat: denial of service via crafted XML input (CVE-2026-45186)

Bug Fix(es) and Enhancement(s):

Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

almalinux/thunderbird<153.5.0-1.el10_2.alma.1

153.5.0-1.el10_2.alma.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/thunderbird to a version that resolves this vulnerability.
Fixed in 153.5.0-1.el10_2.alma.1
Upgrade
Upgrade Mozilla Thunderbird ESR to a version that resolves this vulnerability.
Fixed in 153

Event History

Oct 27, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-45186

Frequently Asked Questions

What must an attacker be able to do to trigger the issue?

They need to cause libexpat to process crafted XML input. The advisory identifies the impact as denial of service.

Does the advisory identify affected package versions or configuration-specific exposure?

No. It does not provide affected or fixed Thunderbird package versions, nor does it state whether any particular configuration, including the default configuration, is affected.

Is a workaround provided for systems that cannot be updated immediately?

No workaround or temporary mitigation is included in the advisory data.

ALSA-2026:90895: Important: thunderbird security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker be able to do to trigger the issue?

Does the advisory identify affected package versions or configuration-specific exposure?

Is a workaround provided for systems that cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to trigger the issue?

Does the advisory identify affected package versions or configuration-specific exposure?

Is a workaround provided for systems that cannot be updated immediately?