{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-113867",
    "url": "https://cveboard.org/i/cve-2026-113867",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-113867",
    "json": "https://cveboard.org/i/cve-2026-113867.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "CVE-2026-113867",
    "summary": "Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then…",
    "titlePt": "CVE-2026-113867",
    "summaryPt": "O Thunderbird não escapava os valores dos atributos ao serializar stanzas XMPP de saída. Como os valores das solicitações recebidas eram ecoados de volta nas respostas automáticas, um usuário XMPP remoto poderia enviar uma solicitação maliciosa que fizesse o Thunderbird injetar stanzas arbitrárias na conexão do usuário, que o servidor então…",
    "affected": [],
    "omitted": 0,
    "references": [],
    "cwes": [
      {
        "id": "CWE-116",
        "name": "Improper Encoding or Escaping of Output"
      }
    ],
    "ssvc": {
      "exploitation": "none",
      "automatable": "yes",
      "impact": "total",
      "at": "2026-10-29T18:27:38.321Z"
    },
    "fix": "unknown",
    "tags": [],
    "description": "Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.",
    "descriptionFrom": "cve",
    "descriptionAt": null,
    "summaryFrom": "cve",
    "cves": [
      "CVE-2026-113867"
    ],
    "ghsa": null,
    "cvss": {
      "score": 9.1,
      "version": "3.1",
      "by": "CISA-ADP"
    },
    "epss": {
      "percentage": 0.00179,
      "percentile": 0.07501,
      "asOf": "2026-10-29",
      "by": "FIRST"
    },
    "packages": [],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "cve.now",
        "url": "https://cve.now/CVE-2026-113867"
      }
    ],
    "cveVersion": 1,
    "cvePending": false,
    "publishedAt": "2026-10-20T19:14:55.002Z",
    "updatedAt": "2026-10-20T19:14:55.002Z"
  },
  "live": true,
  "events": [
    {
      "id": "cvenow:CVE-2026-113867:cvenow_discovered:first",
      "incidentId": "cve-2026-113867",
      "type": "cvenow_discovered",
      "at": "2026-10-20T19:14:55.002Z",
      "detail": {}
    }
  ]
}