Mozilla fixes eight vulnerabilities in the Thunderbird email app with version 158.0.1

Mozilla has published a security advisory for Thunderbird 158.0.1, its email app, announced on 20 October 2026. The advisory lists eight vulnerabilities fixed in this version and gives the release an overall impact rating of High.

Among the issues the advisory lists:

• an account password sent unencrypted while setting up an Exchange account (rated High)
• an injection issue in Thunderbird’s XMPP chat feature (rated High)
• memory disclosure and out-of-bounds read problems in a sign-in method used for POP3 and SMTP mail (rated High)
• a use-after-free issue in S/MIME decryption (rated Moderate)

The other four are shared with the Firefox 158.0.1 advisory, including flaws in SVG handling and in a security block-list component. The advisory doesn’t say that any of these flaws have been exploited.

Who it affects

People who use Thunderbird to read and send email on a computer. The advisory states that the fixes are in Thunderbird 158.0.1.

What Mozilla’s advisory says

The advisory lists Thunderbird 158.0.1 as the version that contains the fixes. Mozilla’s advisory page has the full list of vulnerabilities and their ratings.

Our Windows computer security basics and Mac security basics guides explain how keeping apps updated fits into looking after a computer.