CVE-2026-113869: Use-after-free in S/MIME decryption during a security device password prompt

Q: Who is exposed to this issue?

Thunderbird users who decrypt S/MIME messages and may be prompted for a security device password, such as a smartcard PIN or Primary Password, are exposed. Exploitation requires the affected decryption flow to be active.

Q: What must occur for the use-after-free condition to be triggered?

While Thunderbird is prompting for the security device password during S/MIME decryption, the message load must finish or be cancelled before the prompt is closed. That can free the message decoder while it is still in use.

Q: Is authentication or user interaction required?

The CVSS vector indicates low privileges are required and no separate user interaction is required. The relevant password prompt occurs as part of Thunderbird's S/MIME decryption process.

Q: What version contains the fix?

The issue was fixed in Thunderbird 158.0.1.

Published Oct 20, 2026

Updated

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash.

Affected Software

2 affected componentsFixes available

Mozilla Thunderbird<158.0.1

158.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 158.0.1

Event History

Oct 20, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

Description

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

MFSA2026-114

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Who is exposed to this issue?

Thunderbird users who decrypt S/MIME messages and may be prompted for a security device password, such as a smartcard PIN or Primary Password, are exposed. Exploitation requires the affected decryption flow to be active.

What must occur for the use-after-free condition to be triggered?

While Thunderbird is prompting for the security device password during S/MIME decryption, the message load must finish or be cancelled before the prompt is closed. That can free the message decoder while it is still in use.

Is authentication or user interaction required?

The CVSS vector indicates low privileges are required and no separate user interaction is required. The relevant password prompt occurs as part of Thunderbird's S/MIME decryption process.

What version contains the fix?

The issue was fixed in Thunderbird 158.0.1.

CVE-2026-113869: Use-after-free in S/MIME decryption during a security device password prompt

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What must occur for the use-after-free condition to be triggered?

Is authentication or user interaction required?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must occur for the use-after-free condition to be triggered?

Is authentication or user interaction required?

What version contains the fix?