CVE-2026-113867: Stanza injection in XMPP chat

Q: Who is exposed to this issue?

Only Thunderbird users who use the chat feature with XMPP accounts are affected. Thunderbird installations not using XMPP chat are not affected by this issue.

Q: What does an attacker need to exploit it?

A remote XMPP user must send a crafted request to the target. No user interaction is required because Thunderbird can echo attacker-controlled values in automatic replies.

Q: What could exploitation allow?

The attacker can cause arbitrary XMPP stanzas to be injected into the victim's connection and processed by the server as if the victim sent them. This can allow messages to be sent or contact and subscription settings to be changed on the user's behalf.

Q: Which Thunderbird releases contain the fix?

The vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Published Oct 20, 2026

Updated

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts.

Affected Software

3 affected componentsFixes available

Mozilla Thunderbird<158.0.1

Mozilla Thunderbird<153.5.1

153.5.1

Mozilla Thunderbird<158.0.1

158.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 158.0.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.5.1

Event History

Oct 20, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

Description

Data Sourced

via NVD·08:17 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Who is exposed to this issue?

Only Thunderbird users who use the chat feature with XMPP accounts are affected. Thunderbird installations not using XMPP chat are not affected by this issue.

What does an attacker need to exploit it?

A remote XMPP user must send a crafted request to the target. No user interaction is required because Thunderbird can echo attacker-controlled values in automatic replies.

What could exploitation allow?

The attacker can cause arbitrary XMPP stanzas to be injected into the victim's connection and processed by the server as if the victim sent them. This can allow messages to be sent or contact and subscription settings to be changed on the user's behalf.

Which Thunderbird releases contain the fix?

The vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVE-2026-113867: Stanza injection in XMPP chat

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could exploitation allow?

Which Thunderbird releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could exploitation allow?

Which Thunderbird releases contain the fix?