CVE-2026-113867

Received Received - Intake

XMPP Stanza Injection in Thunderbird

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Mozilla Corporation

Description

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113867

EUVD

EUVD-2026-105294

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 158.0.1 (inc)
mozilla	thunderbird	to 153.5.1 (inc)
mozilla	thunderbird	158.0.1
mozilla	thunderbird	153.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Thunderbird did not properly escape attribute values when serializing outgoing XMPP stanzas. This allowed a remote XMPP user to send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection. The server would then process these stanzas as if they were sent by the user, enabling unauthorized actions.

Detection Guidance

This vulnerability affects Thunderbird's XMPP chat feature. To detect it, check if your Thunderbird version is below 158.0.1 or 153.5.1. Inspect XMPP traffic for unexpected stanzas or unauthorized changes in contact settings.

Impact Analysis

An attacker could send messages or change contact and subscription settings on your behalf without your interaction. This only affects users who have Thunderbird's chat feature enabled with XMPP accounts.

Mitigation Strategies

Update Thunderbird to version 158.0.1 or 153.5.1 or later immediately. Disable the XMPP chat feature if not needed. Monitor XMPP connections for suspicious activity.

Hi! I’m here to help you understand CVE-2026-113867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70