Memory Exhaustion Vulnerability in Thunderbird by Mozilla
CVE-2026-57962

Currently unrated

Key Information:

Vendor: Mozilla
Status: Thunderbird
Vendor: CVE Published:; 1 July 2026

What is CVE-2026-57962?

A security flaw in Mozilla Thunderbird allows a malicious LDAP server, configured for address-book autocomplete, to send excessive attacker-controlled data. This results in memory exhaustion, potentially causing the Thunderbird client to crash. This vulnerability has been addressed in updates 152.0.1 and 140.12.1.

Affected Version(s)

Thunderbird 140.12.1

Thunderbird 152.0.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2042872

https://www.mozilla.org/security/advisories/mfsa2026-62/

https://www.mozilla.org/security/advisories/mfsa2026-63/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 1, 2026
Vulnerability Reserved
Jun 26, 2026

Credit

Michael Bommarito

CVE-2026-57962 Data

JSON