VulnSocial

CVE-2026-113867

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-116

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-29: 110-29
Referenced assets1 URL
By indicator
Full discourse1 post
  • cve.now@cvedotnow

    🔴 Mozilla Thunderbird: stanza injection allows actions as user in XMPP chat (CVE-2026-113867) A remote XMPP user can make the client send messages or change contacts as the victim without user interaction. Disclosed Oct 20 No patch listed yet https://cve.now/CVE-2026-113867

    00000493
    8.2K followersView on X

Explore more

Back to dashboard