Executive brief
Mozilla Thunderbird is a popular email client used for managing communications. A vulnerability in how it processes incoming mail server data could allow a compromised or malicious mail server to crash the application or steal sensitive information from the computer's memory. This could lead to service disruptions or the exposure of private user data.
Technical details
An out-of-bounds read vulnerability (CWE-126) exists in the IMAP parsing component of Mozilla Thunderbird. The flaw is caused by improper handling of length parameters (CWE-130), where a malicious mail server can provide malformed strings with negative lengths. This inconsistency causes the parser to read memory outside the intended buffer. An attacker controlling a mail server or performing a man-in-the-middle attack on the connection can exploit this to trigger a denial-of-service (crash) or disclose sensitive memory contents. The issue is fixed in Thunderbird versions 149 and 140.9.
Affected products
- Mozilla Thunderbird < 149, < 140.9
- Red Hat Enterprise Linux AppStream 8, 10
Timeline
- 2026-03-24: advisory: Mozilla released security advisories MFSA2026-23 and MFSA2026-24.
- 2026-03-24: patched: Fixed in Thunderbird 149 and 140.9.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2023493
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/errata/RHSA-2026:6188
- https://access.redhat.com/errata/RHSA-2026:6342
- https://access.redhat.com/errata/RHSA-2026:6917
- https://access.redhat.com/errata/RHSA-2026:8284