A compromised, malicious, or man‑in‑the‑middle‑controlled Exchange server can deliver a single well‑formed SOAP response that contains an element with many attributes. When Thunderbird processes this payload, the main thread becomes CPU‑bound for seconds to hours, effectively disrupting normal use. This flaw demonstrates uncontrolled resource consumption, as the client processes a message for an extended period.

Mozilla Thunderbird clients running versions earlier than 153.5 or 158 are vulnerable. The issue was fixed in Thunderbird 158 and Thunderbird 153.5, so any older releases remain at risk.

Based on the description, it is inferred that the attacker must control or impersonate the Exchange server that the Thunderbird client contacts, or perform a man‑in‑the‑middle attack to inject the malicious SOAP response. The vulnerability is remote and can be triggered during normal client‑server communication without requiring local authentication. EPSS indicates a very low exploitation probability (<1%), and the flaw is not listed in CISA KEV. The CVSS score of 8.6 places it in the high severity range, while the denial of service can impact end‑user productivity by preventing access to email as the client consumes high CPU resources.