The flaw arises in libmime’s buffer‑growth logic where 32‑bit arithmetic is used without checking for overflow. When a message is large enough, the guard may pass and the buffer may end up smaller than needed. A subsequent memcpy can then overwrite heap slots adjacent to the buffer, corrupting data and potentially allowing arbitrary code execution. This is a classic buffer overflow due to unchecked integer growth, correlating with CWE‑119.

Based on the description, it is inferred that this issue only affects Mozilla Thunderbird users running versions prior to 158. All Thunderbird builds that use the vulnerable libmime implementation are therefore susceptible. Versions 158 and newer contain the patch that prevents the overflow by sizing allocations safely.

The vulnerability does not have a publicly known exploit and no EPSS score is provided. It is not listed in the CISA KEV catalog. However, because the corruption occurs on the heap while processing a message, the description suggests that an attacker could send a crafted email that triggers the overflow, leading to injection of malicious payloads. Based on this inference, the risk remains high for actively targeted victim machines without a patch.