Description
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
Published: 2026-09-30
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A heap-based buffer overflow can be triggered by opening an email that is 2 GB or larger. The overflow corrupts heap memory and causes Thunderbird to crash, disrupting normal operation and potentially denying service to the user. The vulnerability is classified as CWE‑122 and CWE‑787.

Affected Systems

Mozilla Thunderbird is affected. Versions earlier than 157, 140.17, or 153.4 are vulnerable; the issue is fixed in those releases.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1 % shows a very low probability of current exploitation, which is not in the CISA KEV catalog. An attacker would need to convince a user to open a very large email, so the attack vector is primarily social‑engineering based. If the overflow is triggered, it could lead to a crash, creating a denial‑of‑service condition for that client.

Generated by OpenCVE AI on October 17, 2026 at 15:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Thunderbird to the latest fixed release, such as 157, 140.17, or 153.4.
  • Configure mail filtering or policy to block or warn against messages and attachments larger than 2 GB before they reach the client.
  • Inform users about the risk of opening unusually large emails and encourage safe‑mail practices.

Generated by OpenCVE AI on October 17, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4810-1 thunderbird security update
Debian DSA Debian DSA DSA-6536-1 thunderbird security update
History

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

Fri, 16 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Thu, 15 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}

Thu, 01 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla thunderbird

Thu, 01 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 30 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157. An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
References

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157.
Title Heap buffer overflow opening large email
References

Subscriptions

Mozilla Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-16T18:34:02.102Z

Reserved: 2026-09-30T17:15:06.146Z

Link: CVE-2026-103500

cve-icon Vulnrichment

Updated: 2026-10-01T15:28:07.775Z

cve-icon NVD

Status : Modified

Published: 2026-09-30T18:18:18.120

Modified: 2026-10-16T19:17:01.550

Link: CVE-2026-103500

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-30T17:15:06Z

Links: CVE-2026-103500 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T15:30:06Z

Weaknesses