Mozilla Thunderbird: Stanza injection in XMPP chat
Summary
Thunderbird's XMPP chat feature does not escape attribute values in outgoing stanzas. A remote XMPP contact can send a crafted request that is echoed in an automatic reply, causing Thunderbird to inject arbitrary stanzas into the user's connection. The XMPP server then processes them as if the user sent them, which may allow sending messages or changing contact and subscription settings without user interaction. Only Thunderbird's chat feature with XMPP accounts is affected.
Affected
- Mozilla Thunderbird before 153.5.1 (branch 153.x)
- Mozilla Thunderbird before 158.0.1 (branch 158.x)
- Only the chat feature with XMPP accounts is affected.
Fixed in
- Thunderbird 158.0.1
- Thunderbird 153.5.1
- Thunderbird ESR build: Unknown.
Workaround
- No vendor workaround known.
- Unverified: disabling automatic replies or restricting XMPP chat until patched may reduce exposure. Test before relying on this.
Exploitation
- CISA KEV: not listed.
- No known exploitation.
- No public proof-of-concept found.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Update Thunderbird to 158.0.1 or 153.5.1 (or later) on all desktops.
- Identify systems where Thunderbird's XMPP chat is configured and prioritise them.
- Until patched, consider disabling automatic replies or XMPP chat.
- Treat as high priority despite conflicting CVSS scores; Mozilla rates the impact as high.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla advisory MFSA 2026-114 www.mozilla.org
- Mozilla advisory MFSA 2026-115 www.mozilla.org
- Bugzilla 2080073 bugzilla.mozilla.org
- Red Hat CVE data via Vulners vulners.com
- Debian security tracker: Thunderbird security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:14.
Original description (NVD)
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.