Thunderbird performs an S/MIME message decryption when it requests a security device password, such as a smartcard PIN. If the message load finishes or is cancelled while the password prompt remains open, the decoder object is freed while still in use. This results in a use‑after‑free condition that can crash the application and is potentially exploitable by an attacker to execute arbitrary code. The weakness is a classic use‑after‑free bug (CWE‑416).

All Mozilla Thunderbird releases prior to 158.0.1 are affected. The vulnerability manifests only when the user opens an S/MIME message that requires a security device password.

The crash and potential for code execution make this a high‑severity flaw, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation reported yet. The likely attack vector is a crafted S/MIME message sent to a Thunderbird user; the attacker would need to get the user to open the message while the password prompt is displayed. Because the flaw requires the password prompt to be awaiting input, remote exploitation opportunities are limited to social engineering or opportunistic file delivery.