EUVD-2026-90200
GHSA-vjxp-5j85-5rqg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver email ≥2GB to victim
-
ExploitUser opens oversized email
-
ExecutionTrigger heap buffer overflow in Thunderbird
-
ImpactMemory corruption and client crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an email that is greater than or equal to 2GB in size within Thunderbird - this exact size threshold is the concrete trigger condition stated in the description. Limiting factors that sharply reduce realistic risk: mandatory user interaction (UI:R, the user must actively open the message), a local attack vector (AV:L, the oversized message must reach and be opened on the host), and the practical difficulty of delivering and getting a user to open a 2GB+ email, which mail servers and gateways commonly reject or truncate. No special non-default Thunderbird configuration is required; the ceiling of impact is availability (crash) with limited integrity, not confidentiality loss. |
| Impact | This is a low-priority issue despite its MEDIUM 6.1 CVSS rating. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) describes a locally-triggered memory-corruption flaw requiring user interaction, with impact skewed toward availability (A:H, likely crash) and only limited integrity (I:L), no confidentiality loss (C:N). The signals are consistent and all point low: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is identified. The single most important real-world limiter is the exploitation precondition - the victim must open an email that is greater than or equal to 2GB - which is an extraordinarily unusual and conspicuous artifact to deliver and have a user open. No signals conflict; the only nuance worth stating is that the CWE-787 (out-of-bounds write) classification theoretically raises the specter of code execution, but Mozilla's own impact rating (C:N/I:L/A:H) indicates the practical outcome is denial of service / memory corruption rather than confirmed RCE. Vendor-reported by Mozilla and fixed in Thunderbird 157. |
| Exploit ScenarioDerived | An attacker crafts and delivers an email of 2GB or larger and socially engineers the victim into opening it in Thunderbird, triggering a heap buffer overflow that corrupts memory and most likely crashes the client (A:H). No public exploit code is identified at time of analysis, and the enormous message size makes delivery and successful user interaction highly impractical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.
RemediationAI
Apply the vendor-released patch by upgrading Mozilla Thunderbird to version 157 or later, per Mozilla's security advisories (MFSA 2026-101 and the related 2026-102/2026-103 advisories); this is the definitive fix and addresses the heap overflow directly. As a compensating control where immediate upgrade is not possible, enforce server- or gateway-side maximum message size limits well below 2GB so oversized messages are rejected or truncated before reaching clients - noting that legitimate users who genuinely exchange extremely large attachments would be blocked by such limits, so the threshold should be set above normal business mail sizes. Blocking or quarantining inbound messages at or near the 2GB boundary via MTA and content-filtering rules reduces exposure, and operators should also monitor for repeated Thunderbird client crashes as a potential indicator that an oversized message triggered the defect. None of these workarounds fully eliminate the flaw, so the version upgrade remains the recommended action.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write), specifically a heap buffer overflow in Thunderbird's handling of message content. Thunderbird parses email through its MIME/message-handling pipeline, and the vulnerability is triggered by a size-handling edge case when a message is 2GB or larger - a boundary that stresses integer/length arithmetic around message buffers. When the buffer is under-allocated or a length calculation overflows/miscomputes at that extreme size, subsequent parsing writes past the end of the heap allocation, corrupting adjacent memory and leading to a crash. The CPE cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:* * indicates the issue applies to the Thunderbird mail client generally up to the fixed build, rather than to a platform-specific package. Because it is a client-side parser defect, exploitation is initiated by the content of a malicious/oversized email rather than by a network service, consistent with the local attack vector and required user interaction in the assessed CVSS vector.
Know when Thunderbird gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Locally-opened email so AV:L; no auth so PR:N but victim must open the message so UI:R; impact is mainly crash (A:H) with limited integrity from memory corruption and no confidentiality loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)NVD
More in Thunderbird
View allMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Alpine Linux: mozjs fixed in 128.3.1-r0
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB