CVE-2026-4371: Mozilla Thunderbird out of bounds read in IMAP parsing

CVE-2026-4371 · Severity: high · CVSS 7.4 · Published 2026-03-24

Mozilla Thunderbird is a popular email client used for managing communications. A vulnerability in how it processes incoming mail server data could allow a compromised or malicious mail server to crash the application or steal sensitive information from the computer's memory. This could lead to service disruptions or the exposure of private user data.

Technologies: Mozilla Thunderbird, Red Hat Enterprise Linux AppStream. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-4371 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4371 being exploited in the wild.
How severe is CVE-2026-4371?
High severity, with a CVSS score of 7.4, published 24 March 2026.
Which products and versions are affected?
Mozilla Thunderbird < 149, < 140.9; Red Hat Enterprise Linux AppStream 8, 10.
Is there a fix for CVE-2026-4371?
A patch was published on 2026-03-24: Fixed in Thunderbird 149 and 140.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4371 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4371?
Check whether you run Mozilla Thunderbird or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-126) exists in the IMAP parsing component of Mozilla Thunderbird. The flaw is caused by improper handling of length parameters (CWE-130), where a malicious mail server can provide malformed strings with negative lengths. This inconsistency causes the parser to read memory outside the intended buffer. An attacker controlling a mail server or performing a man-in-the-middle attack on the connection can exploit this to trigger a denial-of-service (crash) or disclose sensitive memory contents. The issue is fixed in Thunderbird versions 149 and 140.9.

Affected products

  • Mozilla Thunderbird < 149, < 140.9
  • Red Hat Enterprise Linux AppStream 8, 10

Timeline

  • 2026-03-24: advisory: Mozilla released security advisories MFSA2026-23 and MFSA2026-24.
  • 2026-03-24: patched: Fixed in Thunderbird 149 and 140.9.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.