RLSA-2026:90895: Important: thunderbird security, bug fix, and enhancement update

Q: What is the practical impact of this issue?

The issue can cause a denial of service when libexpat processes crafted XML input. The provided CVSS vector indicates network reachability, low attack complexity, no required privileges or user interaction, and impact limited to availability.

Q: Which systems should be prioritized for remediation?

Systems running the Rocky Linux Thunderbird package should be prioritized, particularly where Thunderbird may process XML content from untrusted sources. The advisory identifies libexpat as the affected component.

Q: Does exploitation require an authenticated account or user interaction?

No. The supplied CVSS vector lists PR:N and UI:N, indicating that exploitation does not require attacker privileges or user interaction.

Published Oct 29, 2026

Updated

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

libexpat: denial of service via crafted XML input (CVE-2026-45186)

Bug Fix(es) and Enhancement(s):

Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:Rocky Linux-175207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/thunderbird<0:153.5.0-1.el10_2

0:153.5.0-1.el10_2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/thunderbird to a version that resolves this vulnerability.
Fixed in 0:153.5.0-1.el10_2
Upgrade
Upgrade Thunderbird ESR to a version that resolves this vulnerability.
Fixed in 153

Event History

Oct 29, 2026

Advisory Published

via OSV·12:08 PM

Data Sourced

via OSV·12:08 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-45186

Frequently Asked Questions

What is the practical impact of this issue?

The issue can cause a denial of service when libexpat processes crafted XML input. The provided CVSS vector indicates network reachability, low attack complexity, no required privileges or user interaction, and impact limited to availability.

Which systems should be prioritized for remediation?

Systems running the Rocky Linux Thunderbird package should be prioritized, particularly where Thunderbird may process XML content from untrusted sources. The advisory identifies libexpat as the affected component.

Does exploitation require an authenticated account or user interaction?

No. The supplied CVSS vector lists PR:N and UI:N, indicating that exploitation does not require attacker privileges or user interaction.

RLSA-2026:90895: Important: thunderbird security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What is the practical impact of this issue?

Which systems should be prioritized for remediation?

Does exploitation require an authenticated account or user interaction?

Company

Resources

Contact

Frequently Asked Questions

What is the practical impact of this issue?

Which systems should be prioritized for remediation?

Does exploitation require an authenticated account or user interaction?