This vulnerability arises when Thunderbird authenticates to a POP3 or SMTP server using NTLM. The client decodes the server’s challenge message as Base64 without validating its integrity. A malicious server can supply an invalid or padding‑only challenge, causing Thunderbird to append uninitialized heap memory into the NTLM response or perform an out‑of‑bounds read and crash. The memory disclosure affects only NTLM authentication, whereas the out‑of‑bounds read can be leveraged for a denial‑of‑service attack. This is an instance of CWE-125 and CWE-908.

Mozilla Thunderbird client versions released before 158.0.1 or 153.5.1 are affected. The issue applies to all accounts configured to use NTLM or GSSAPI authentication, but the data‑leak path is specific to NTLM. No affected Linux versions are mentioned in the advisory.

The advisory assigns a CVSS score of 5.3. The EPSS score indicates a very low probability of exploitation, in the less than 1% range, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a compromised or malicious POP3/SMTP server that sends a crafted NTLM challenge; this inference is drawn from the description. The probability of exploitation is uncertain and depends on an attacker’s ability to control the mail server. As a result, the risk is considered moderate, primarily affecting confidentiality for users who authenticate via NTLM and offering a potential crash path that could be used for denial of service.