Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-4371

Out of bounds read in IMAP parsing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mozilla

Description

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Thunderbird

  • 140.9 to ≤ 140.*unaffected
  • 149 to ≤ *unaffected

References