EUVD-2026-69709
GHSA-2q8r-2ghc-82v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
One-byte over-read limits confidentiality impact to C:L; no write or crash described so I:N/A:N; auto-header processing on sync justifies UI:N.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
5DescriptionCVE.org
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
AnalysisAI
Thunderbird's mail header parser triggers a one-byte buffer over-read (CWE-126) when processing a maliciously crafted message header, potentially exposing a single byte of adjacent heap memory to the sender. All Thunderbird versions across three active release branches are affected until patched - 155, 140.15, and 153.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special Thunderbird configuration is required beyond running an unpatched version connected to a mail account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects that Thunderbird auto-processes headers on mail receipt, requiring no privileges or user interaction - all accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Thunderbird 155, Thunderbird 140.15, or Thunderbird 153.2 depending on the active release branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Thunderbird deployments across the organization and identify which teams handle sensitive communications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Thunderbird
View allMozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Alpine Linux: mozjs fixed in 128.3.1-r0
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS
Same weakness CWE-126 – Buffer Over-read
View allShare
External POC / Exploit Code
Leaving vuln.today