Several buffer‑growth sites in libmime use 32‑bit arithmetic without overflow checks. When a message is large enough, the size guard can pass or the buffer may be reallocated smaller than needed, causing a subsequent memcpy to write attacker‑controlled data across adjacent heap allocations. This results in heap corruption that can lead to arbitrary code execution. The flaw is an unchecked integer overflow and a heap buffer overflow, identified as CWE‑190 and CWE‑787.

Based on the description, this vulnerability affects Mozilla Thunderbird users running versions older than 158 as well as any builds prior to 153.6. Both releases 158 and 153.6 contain the patch that safely sizes allocations, preventing the overflow.

The vulnerability has a CVSS score of 8.4 and an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. Because the corruption occurs on the heap while processing a message, the description suggests that an attacker could send a crafted email that triggers the overflow, leading to injection of malicious payloads. Based on this inference, the risk remains high for actively targeted victim machines without a patch.