CVE-2026-113867
Description
A flaw was found in Thunderbird. Due to improper escaping of attribute values when serializing outgoing Extensible Messaging and Presence Protocol (XMPP) messages, incoming request data is reflected in automatic responses without sanitization. A remote attacker can exploit this flaw by sending a crafted request that injects arbitrary protocol commands into the client's connection. This allows the attacker to perform unauthorized actions on behalf of the victim without interaction, such as sending messages or modifying contact and subscription settings.
Statement
This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires the victim to have an active XMPP account configured and connected within Thunderbird's chat client. While an attacker can inject unauthorized protocol directives into an established session without direct user interaction, the blast radius is strictly confined to the instant messaging profile, allowing unauthorized roster modifications or message dispatch without compromising local files or executing arbitrary code on the host. In default Red Hat Enterprise Linux installations, Thunderbird is primarily deployed for email rather than XMPP communications, and chat accounts are not enabled by default.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands; Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
