Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

published 2026-05-19 5 mo ago modified 2026-10-14 25 d ago also EUVD-2026-30910

cvss: 9.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Patch / fix

fixed in 2 distros 4

mozilla firefox 140.11.0, 151.0.0
mozilla thunderbird 140.11, 151.0.0

red hat opensuse almalinux rocky linux

thunderbird RHEL 8 140.11.0-1.el8_10
thunderbird RHEL 10.2 140.11.0-1.el10_2
thunderbird RHEL 9 140.11.0-1.el9_8
thunderbird enterprise linux eus 10.0 140.11.0-1.el10_0
thunderbird RHEL 8.6 EUS_LONG_LIFE, RHEL 8.6 AUS 140.11.0-1.el8_6
thunderbird RHEL 9.6 EUS 140.11.0-1.el9_6
thunderbird RHEL 8.8 TUS, RHEL 8.8 E4S 140.11.0-1.el8_8
thunderbird RHEL 9.2 E4S 140.11.0-1.el9_2

red hat advisories RHSA-2026:26539 RHSA-2026:26536 RHSA-2026:26521 RHSA-2026:26268 RHSA-2026:26269 RHSA-2026:26270

MozillaThunderbird openSUSE Leap 16.0 140.12.0-bp160.1.1
MozillaFirefox openSUSE Tumbleweed 151.0.1-1.1
MozillaThunderbird openSUSE Tumbleweed 140.11.1-1.1
firefox-esr openSUSE Tumbleweed 140.11.0-1.1

opensuse advisories openSUSE-SU-2026:21168-1 openSUSE-SU-2026:10863-1 openSUSE-SU-2026:10864-1 openSUSE-SU-2026:10813-1

thunderbird AlmaLinux 8 140.11.0-1.el8_10.alma.1
thunderbird AlmaLinux 10 140.11.0-1.el10_2.alma.1
thunderbird AlmaLinux 9 140.11.0-1.el9_8.alma.1

almalinux advisories ALSA-2026:22643 ALSA-2026:22325 ALSA-2026:21381

thunderbird Rocky Linux 8 140.11.0-1.el8_10
thunderbird Rocky Linux 10 140.11.0-1.el10_2
thunderbird Rocky Linux 9 140.11.0-1.el9_8

rocky linux advisories RLSA-2026:22643 RLSA-2026:22325 RLSA-2026:21381

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-8959 updated 2026-11-06 cvss 6.1

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Red Hat Enterprise Linux 6 thunderbird Red Hat Enterprise Linux 7 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 10 rhel10/thunderbird-flatpak
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 8) thunderbird 140.11.0-1.el8_10
fixed: vendor fix RHSA-2026:22643
Red Hat Enterprise Linux AppStream (v. 9) thunderbird 140.11.0-1.el9_8
fixed: vendor fix RHSA-2026:21381
Red Hat Enterprise Linux AppStream (v. 10) thunderbird 140.11.0-1.el10_2
fixed: vendor fix RHSA-2026:22325
Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird 140.11.0-1.el8_4
fixed: vendor fix RHSA-2026:26270
Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird 140.11.0-1.el8_6
fixed: vendor fix RHSA-2026:26536
Red Hat Enterprise Linux AppStream E4S (v.8.8) thunderbird 140.11.0-1.el8_8
fixed: vendor fix RHSA-2026:26268

show 8 more

Red Hat Enterprise Linux AppStream E4S (v.9.2) thunderbird 140.11.0-1.el9_2
fixed: vendor fix RHSA-2026:26269
Red Hat Enterprise Linux AppStream E4S (v.9.4) thunderbird 140.11.0-1.el9_4
fixed: vendor fix RHSA-2026:26174
Red Hat Enterprise Linux AppStream EUS (v. 10.0) thunderbird 140.11.0-1.el10_0
fixed: vendor fix RHSA-2026:26539
Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird 140.11.0-1.el9_6
fixed: vendor fix RHSA-2026:26521
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) thunderbird 140.11.0-1.el8_4
fixed: vendor fix RHSA-2026:26270
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) thunderbird 140.11.0-1.el8_6
fixed: vendor fix RHSA-2026:26536
Red Hat Enterprise Linux AppStream TUS (v.8.8) thunderbird 140.11.0-1.el8_8
fixed: vendor fix RHSA-2026:26268
Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 firefox Red Hat Enterprise Linux 9 firefox, firefox-x11 Red Hat Enterprise Linux 10 firefox, rhel10/firefox-flatpak
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 5 mo ago (2026-05-19)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Mozilla Firefox
Mozilla Thunderbird

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-20 Improper Input Validation
CWE-693 Protection Mechanism Failure

References

mozilla.org /security/advisories/mfsa2026-46/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-48/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-50/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-51/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=2034754
permissions-required

Sources

CVE List CVE-2026-8959
NVD CVE-2026-8959

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary