CVE-2026-113867

Awaiting Analysis Awaiting Analysis - Queue

XMPP Stanza Injection in Thunderbird

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Mozilla Corporation

Description

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113867

EUVD

EUVD-2026-105294

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 158.0.1 (inc)
mozilla	thunderbird	to 153.5.1 (inc)
mozilla	thunderbird	158.0.1
mozilla	thunderbird	153.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

Thunderbird did not properly escape attribute values when serializing outgoing XMPP stanzas. This allowed a remote XMPP user to send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection. The server would then process these stanzas as if they were sent by the user, enabling unauthorized actions.

Detection Guidance

This vulnerability affects Thunderbird's XMPP chat feature. To detect it, check if your Thunderbird version is below 158.0.1 or 153.5.1. Inspect XMPP traffic for unexpected stanzas or unauthorized changes in contact settings.

Impact Analysis

An attacker could send messages or change contact and subscription settings on your behalf without your interaction. This only affects users who have Thunderbird's chat feature enabled with XMPP accounts.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves unauthorized message sending or settings changes via XMPP in Thunderbird. However, if exploited, it could lead to unauthorized data disclosure or modification, which may violate privacy requirements under GDPR or HIPAA depending on the context of use.

Mitigation Strategies

Update Thunderbird to version 158.0.1 or 153.5.1 or later immediately. Disable the XMPP chat feature if not needed. Monitor XMPP connections for suspicious activity.

Hi! I’m here to help you understand CVE-2026-113867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...