CVE-2022-1520

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-22 · updated 2026-06-17
Weakness: CWE-346

Description

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.

Affected products

Mozilla Thunderbird: before 91.9 — fixed in 91.9

How to fix

Upgrade to a fixed version: Mozilla Thunderbird 91.9. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1745019
https://www.mozilla.org/security/advisories/mfsa2022-18/
https://bugzilla.mozilla.org/show_bug.cgi?id=1745019
https://www.mozilla.org/security/advisories/mfsa2022-18/

Get alerted when CVE-2022-1520 or the next vulnerability affects your stack