Mozilla releases Thunderbird 159 with fixes for email-handling flaws

Mozilla has published a security advisory for Thunderbird 159, its email app, announced on 27 October 2026. The advisory gives the release an overall impact rating of High.

Examples from the advisory’s list include:

• displaying a message could load a web address chosen by an attacker through an OpenPGP key attachment (rated High; OpenPGP is a system for encrypting and signing email)
• replying to a specially crafted message could include content from other messages (rated High)
• information disclosure caused by uninitialised memory in the audio and video component (rated High)
• request forgery through “news:” links (rated Moderate)

The advisory notes that many of these flaws can’t be exploited through email, because scripting is turned off when reading mail, but says they could still be a risk in browser or browser-like contexts. It doesn’t say that any of the flaws have been exploited.

Who it affects

People who use Thunderbird to read and send email on a computer. The advisory lists Thunderbird as the affected product, with the fixes in Thunderbird 159.

What Mozilla’s advisory says

The advisory identifies Thunderbird 159 as the version containing the fixes. Mozilla’s advisory page has the full list of vulnerabilities and their ratings. Our earlier item on Thunderbird 158.0.1 covers the previous round of fixes.

Our Windows computer security basics and Mac security basics guides explain how keeping apps updated fits into looking after a computer.