Description

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T22:17:19.900Z",
  "pubdate": "2026-09-01T22:17:19.900Z",
  "executiveSummary": "A critical memory corruption vulnerability exists in the IMAP implementation of Thunderbird, involving both a use-after-free (UAF) condition and heap-memory disclosure.\nThis vulnerability is triggered through the processing of a maliciously crafted ID response from an IMAP server.\nThe primary risk involves the potential for arbitrary memory disclosure and the unintended persistence of sensitive heap data into the application configuration file, prefs.js.\nBy manipulating server responses, an unauthenticated remote attacker can force the client to process malformed data, leading to memory mismanagement.\nThe impact is significant, as it could facilitate information leakage, potentially exposing credentials, session tokens, or other sensitive user data stored within the heap to the local disk via prefs.js.\nAffected products include Thunderbird versions 155, 140.15, and 153.2. Organizations and users are advised to update to the latest patched versions immediately to remediate these memory safety flaws.",
  "technicalDetails": "The vulnerability resides within the IMAP protocol handler of Thunderbird, specifically in the logic responsible for parsing and handling the ID response sequence.\nThe root cause is a use-after-free defect occurring when the IMAP client attempts to access memory that has already been deallocated during the parsing of a maliciously constructed response.\nIn the attack flow, a malicious IMAP server initiates a session with the Thunderbird client. Upon receiving a specific ID response command, the client's parser fails to correctly manage the lifecycle of an underlying memory object, leading to a dangling pointer.\nWhen the client subsequently attempts to interact with this pointer, it accesses invalidated memory regions. Concurrent with this, the vulnerability enables heap-memory disclosure, where the contents of freed heap blocks—potentially containing sensitive information from previous allocations—are accessed or referenced.\nThe exploit mechanism involves the attacker providing a crafted response that triggers the UAF state. By controlling the timing or content of subsequent memory allocations, the attacker can influence the state of the heap.\nA critical post-exploitation consequence of this vulnerability is the unintended persistence of these disclosed heap contents. Because the application logic may write parts of the object state or associated preferences into prefs.js, the sensitive memory leaked during the heap-disclosure phase is effectively serialized and stored on the local file system.\nThis creates an exfiltration vector where a local attacker or a malicious script with filesystem access could parse prefs.js to recover the heap data leaked during the initial IMAP interaction.\nThe exploitation does not explicitly require user authentication for the initial trigger, as the IMAP handshake occurs during server communication. However, it does require a network-exposed environment where an attacker can impersonate or control an IMAP server that the targeted Thunderbird instance connects to.\nSuccessful exploitation hinges on the attacker's ability to trigger the faulty parsing logic within the IMAP state machine, circumventing memory safety protections implemented in the client."
}