Thunderbird CVE-2026-14899

Exploitation requires the Thunderbird user to manually forward a message from an attacker while the 'View All Headers' option is enabled in the forwarding compose window; this option is not active by default. Thus, user interaction and a changed default setting are necessary. Remote, automated triggering without user action is not possible.

CVSS:3.1 vector supplied with the CVE rates the vulnerability 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), implying high confidentiality impact from remote, no-interaction exploitation. However, the description makes clear that user interaction is required (forwarding a message with a non-default setting enabled), and the actual confidentiality impact is limited to a single byte, which may not constitute a reliable information leak. An independent assessment yields AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (score 6.5), reflecting the primarily denial-of-service nature. EPSS probability is 0.19% (percentile 8%), indicating low likelihood of exploitation in the wild. With no public exploit code and no CISA KEV listing, risk is moderate at most; the non-default configuration requirement further reduces exposure. The CVSS 7.5 should be treated with caution as it overstates the realistic impact.

An attacker crafts an email with specially formed MIME headers and sends it to a victim. When the victim attempts to forward that email from Thunderbird with the 'view all headers' option enabled, the vulnerable parser reads one byte beyond the header buffer, causing the email client to crash. A proof-of-concept exploit would reliably crash Thunderbird, but information disclosure beyond a single byte is improbable.