CVE-2026-113867Stanza injection in XMPP chat
Updated under an hour ago ()
Does this affect you?
It affects Mozilla Thunderbird. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mozilla
- NVD analysis
- Received
- Record last updated
- Oct 20, 2026
- First seen by InfoSec Signals
- Oct 20, 2026
Affected products
Mozilla Thunderbird mozilla:thunderbird (from the name) | 153.5.1 builds before 153.* not affected; from 158.0.1 not affected | CNA record |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2080073
- https://www.mozilla.org/security/advisories/mfsa2026-114/
- https://www.mozilla.org/security/advisories/mfsa2026-115/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.