Buffer Overflow Vulnerability in Thunderbird by Mozilla

CVE-2026-4371

What is CVE-2026-4371?

A vulnerability exists in Thunderbird that allows a malicious mail server to send malformed strings with negative lengths, leading to potential buffer overflow conditions. This may cause the mail parser to read beyond the buffer limits, resulting in application crashes or the leakage of sensitive information. The affected versions of Thunderbird include those prior to 149 and 140.9. Users are advised to ensure their software is updated to mitigate risks associated with this vulnerability.

References