EUVD-2026-69710
GHSA-f2hg-25f8-vgfj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-triggered via IMAP auto-connect with no auth or UI interaction; C:H reflects heap disclosure persisted to disk, I:N and A:N per described impact.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
4DescriptionCVE.org
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
AnalysisAI
Heap memory disclosure in Mozilla Thunderbird's IMAP client allows a malicious IMAP server to trigger a use-after-free by sending a crafted ID extension response, leaking heap contents that are subsequently persisted to the user's prefs.js file on disk. All Thunderbird releases prior to 155, 140.15 (ESR), and 153.2 across three active release channels are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim's Thunderbird is configured with at least one IMAP account whose server is controlled by or accessible to the attacker - either via direct server operation, DNS/BGP hijacking of a legitimate IMAP hostname, or MitM on an unprotected IMAP connection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects that exploitation requires no authentication from the attacker and no user interaction once Thunderbird is configured with an IMAP account, as mail fetching is automatic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Thunderbird 155, Thunderbird 140.15, or Thunderbird 153.2 as appropriate for the deployed release channel, per Mozilla advisories mfsa2026-86, mfsa2026-87, and mfsa2026-88 at https://www.mozilla.org/security/advisories/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Thunderbird installations in your environment to identify versions before 155 (release channel), 140.15 (ESR channel), or 153.2 (beta channel). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Thunderbird
View allMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Alpine Linux: mozjs fixed in 128.3.1-r0
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today