When Thunderbird requested a security device password while decrypting an S/MIME message, the ongoing message load could finish or be cancelled while the password prompt stayed open. If the message load finishes or is cancelled while the password prompt remains open, the decoder object is freed while still in use, resulting in a use‑after‑free condition that can crash the application. This flaw is identified as CWE‑416 and CWE‑825.

All Mozilla Thunderbird releases prior to 158.0.1 are affected. The vulnerability manifests only when the user opens an S/MIME message that requires a security device password.

The CVSS score of 5.4 indicates a medium severity. The EPSS score of < 1 % reflects a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, meaning no public exploitation is reported yet. The likely attack vector is a crafted S/MIME message sent to a Thunderbird user; the attacker would need to get the user to open the message while the password prompt is displayed. Because the flaw requires the password prompt to be awaiting input, remote exploitation opportunities are limited to social engineering or opportunistic file delivery.