Description

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T22:17:19.800Z",
  "pubdate": "2026-09-01T22:17:19.800Z",
  "executiveSummary": "A memory safety vulnerability exists in Thunderbird originating from improper handling of maliciously crafted mail headers, resulting in a one-byte out-of-bounds read past the end of a buffer. This vulnerability affects Thunderbird versions prior to 155, 140.15, and 153.2.\nThe vulnerability is categorized as an out-of-bounds (OOB) memory access error. By sending a specially crafted email, an unauthenticated remote attacker can trigger the read, potentially leading to unauthorized memory disclosure or application instability. The impact ranges from information leakage of adjacent memory contents to a crash (denial of service).\nExploitation does not require elevated privileges or authentication, as the vulnerable code path is triggered during the standard parsing of mail headers upon receipt or processing by the client. Organizations and users are strongly advised to update to the latest patched versions to mitigate the risks associated with memory corruption and potential data exposure.",
  "technicalDetails": "The vulnerability is an out-of-bounds read error occurring within the mail header parsing logic of Thunderbird. Memory safety issues of this nature typically arise when the software fails to perform adequate bounds checking on input data length before executing memory copy or access operations. In this instance, a maliciously constructed mail header provides length metadata that causes the parser to exceed the allocated buffer size by one byte during the reading process.\nThe root cause lies in a discrepancy between the expected structure of the mail header and the actual bytes processed by the header-parsing function. When the parser encounters an malformed header, it proceeds to read beyond the designated memory block. This behavior is symptomatic of an off-by-one error during the boundary verification phase of the buffer read operation.\nThe attack flow begins when an attacker transmits a maliciously crafted email message to a victim. Upon the arrival of this email, the Thunderbird client’s mail processing engine attempts to parse the headers. The parser, failing to validate the boundaries of the header field properly, reads one byte beyond the end of the heap-allocated or stack-allocated buffer. Because the parser is performing this read operation on user-supplied content within a network-exposed protocol, the attacker maintains control over the data trigger mechanism.\nThe technical impact of a single-byte out-of-bounds read is primarily centered on information disclosure. By reading adjacent memory, an attacker may be able to glean sensitive information such as pointers, configuration data, or other residual stack/heap information that was present in the memory space immediately following the buffer. In certain architectural contexts, repetitive exploitation or chaining with other primitives might lead to bypasses of memory randomization techniques (e.g., ASLR), although the primary immediate risk remains the leakage of arbitrary memory bytes into the application's processing state.\nThe vulnerability affects Thunderbird versions prior to 155, 140.15, and 153.2. As the parsing occurs during the automated handling of incoming mail, the exploit vector is network-based and requires no user interaction beyond the receipt of the malicious message. The lack of robust bounds checking within the parser represents a significant deficiency in the input validation layer of the component responsible for protocol-level header sanitization."
}