CVE-2026-113869Published

Use-after-free in S/MIME decryption during a security device password prompt

Exact source revision recorded 27 Oct 2026 19:45:55 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-113869

Published

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.

Source published: 20 Oct 2026 19:14:55 UTC
Source modified: 27 Oct 2026 18:30:32 UTC
Observed here: 27 Oct 2026 19:45:55 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.