CVE-2026-113867

A flaw was found in Thunderbird. Due to improper escaping of attribute values when serializing outgoing Extensible Messaging and Presence Protocol (XMPP) messages, incoming request data is reflected in automatic responses without sanitization. A remote attacker can exploit this flaw by sending a crafted request that injects arbitrary protocol commands into the client's connection. This allows the attacker to perform unauthorized actions on behalf of the victim without interaction, such as sending messages or modifying contact and subscription settings.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires the victim to have an active XMPP account configured and connected within Thunderbird's chat client. While an attacker can inject unauthorized protocol directives into an established session without direct user interaction, the blast radius is strictly confined to the instant messaging profile, allowing unauthorized roster modifications or message dispatch without compromising local files or executing arbitrary code on the host. In default Red Hat Enterprise Linux installations, Thunderbird is primarily deployed for email rather than XMPP communications, and chat accounts are not enabled by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.