CVE-2026-45447

🚨 CVE-2026-45447 - Critical OpenSSL Use-After-Free Vulnerability Heap Use-After-Free in PKCS7verify allowing memory corruption, crashes, and potential remote code execution. 📖 Executive Summary CVE-2026-45447 is a critical vulnerability in OpenSSL's PKCS7 verification functionality. The flaw exis...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL (CVE-2026-82418)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition, due to versions of OpenSSL included in wheels prior to cryptograph 48.01 which could allow specially crafted PKCS7 or S/MIME signed messages to trigger a use-after-free during PKCS7 signature verification...

CLSA-2026-1785560172 thunderbird: Fix of 255 CVEs

rebase from Thunderbird 115.4.1 to 140.12.0 ESR - CVE-2022-3032: When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked -...

SUSE CVE-2026-113869

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

Atlassian Confluence < 9.2.24 / 9.5.x < 10.2.17 / 11.0.0 (CONFSERVER-104476)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104476 advisory. - In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy...

Linux Distros Unpatched Vulnerability : CVE-2026-113869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load...

CVE-2026-113869

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled...

CVE-2026-113869 Use-after-free in S/MIME decryption during a security device password prompt

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

EUVD-2026-105296

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869 Use-after-free in S/MIME decryption during a security device password prompt

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869

Mozilla Thunderbird versions earlier than 158.0.1 are vulnerable to a use-after-free memory error during S/MIME message decryption. The flaw occurs when a message load finishes or is canceled while an interactive password prompt (e.g., for a smartcard PIN or Primary Password) is still open, causi...

CVE-2026-113869

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

PT-2026-118621

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 158.0.1 Description A use-after-free issue occurs during the decryption of an S/MIME message when the application prompts for a security device password, such as a smartcard PIN or the Primary Password. If the...

Red Hat: CVE-2026-113869: thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

KLA91360 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security vulnerability can be exploited to bypass securit...

Mozilla Thunderbird resource management error vulnerability

Versions of Mozilla Thunderbird prior to 158.0.1 contain a resource management error vulnerability. This vulnerability arises when the password for a security device—such as a smart card PIN or master password—is requested during the decryption of S/MIME messages. The prompt may appear to indicat...

CVE-2026-93635

The Zimbra Collaboration Suite (versions 10.1.0 through 10.1.21) is vulnerable to an LDAP filter injection caused by unescaped computeDn() template substitutions. This flaw allows unauthenticated attackers to manipulate external LDAP search filters. In environments utilizing search-filter authent...