Executive brief
Mozilla Thunderbird, a popular email client, contained a flaw in how it handles email headers when a user forwards a message. If a specific setting to view all headers was enabled, an attacker could potentially cause the application to crash. While the risk of data theft is low, this could lead to service disruptions for the user.
Technical details
An off-by-one error exists in the MIME header parsing logic of Mozilla Thunderbird. The vulnerability is triggered when a user forwards a message while the 'view all headers' setting is enabled. This flaw allows a single byte to be read from memory beyond the allocated buffer (out-of-bounds read). While primarily resulting in an application crash (Denial of Service), it represents a memory safety issue. The vulnerability is fixed in Thunderbird 153 and Thunderbird 140.13.
Affected products
- Mozilla Thunderbird Versions prior to 153 and 140.13
Timeline
- 2026-07-21: advisory: Mozilla Foundation Security Advisory 2026-71 and 2026-72 released.
- 2026-07-22: disclosed: CVE-2026-14899 published to NVD.