Log in Start free

Vulnerability · Published Mar 24, 2026 · Assigned by mozilla

CVE-2026-4371Out of bounds read in IMAP parsing

High 7.4

In plain English

A high-severity security flaw in Thunderbird from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 69.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10thunderbird140.9.0-1.el10_1.alma.1ALSA-2026:6342
AlmaLinux:8thunderbird140.9.0-1.el8_10.alma.1ALSA-2026:6917
AlmaLinux:9thunderbird140.9.0-1.el9_7.alma.1ALSA-2026:6188
Debian:12thunderbird1:140.9.0esr-1~deb12u1DEBIAN-CVE-2026-4371
Debian:12thunderbird1:140.9.0esr-1~deb12u1DSA-6179-1
Debian:13thunderbird1:140.9.0esr-1~deb13u1DSA-6179-1
Debian:13thunderbird1:140.9.0esr-1~deb13u1DEBIAN-CVE-2026-4371
Debian:14thunderbird1:140.9.0esr-1DEBIAN-CVE-2026-4371
Rocky Linux:10thunderbird0:140.9.0-1.el10_1RLSA-2026:6342
Rocky Linux:8thunderbird0:140.9.0-1.el8_10RLSA-2026:6917
Rocky Linux:9thunderbird0:140.9.0-1.el9_7RLSA-2026:6188
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2026-4371
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2026-4371
Ubuntu:24.04:LTSmozjs115no fix listedUBUNTU-CVE-2026-4371
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2026-4371
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2026-4371
Ubuntu:22.04:LTSthunderbirdno fix listedUBUNTU-CVE-2026-4371

Affected products (as reported)

VendorProductVersions
Mozilla Thunderbird see references

Weakness: CWE-126, CWE-130 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References