Critical severity · published Oct 20, 2026
CVE-2026-113867
Stanza injection in XMPP chat
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113867
bugzilla.mozilla.org
https://bugzilla.mozilla.org/show_bug.cgi?id=2080073
www.mozilla.org
https://www.mozilla.org/security/advisories/mfsa2026-114/
www.mozilla.org
https://www.mozilla.org/security/advisories/mfsa2026-115/