A malicious mail server can send malformed strings with negative lengths, causing the IMAP parser to read outside its buffer. This out-of-bounds read can crash Thunderbird or expose sensitive data. The weakness is identified as CWE-126 and CWE-130, representing insecure memory handling and boundary checks.

The vulnerability affects Mozilla Thunderbird on all versions prior to 149 and the ESR branch prior to 140.9. Any user running these vulnerable Thunderbird releases is at risk when connecting to an IMAP server that can be compromised or set up to feed malformed data.

The CVSS score of 7.4 indicates a moderate to high severity. The EPSS score is below 1%, suggesting low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is inferred to be an adversary who can control mail server content or compromise the mail server connection. Exploitation requires the victim to receive a crafted IMAP response, after which the parser may crash or expose memory. Timely patching is therefore recommended to mitigate both possible denial of service and confidentiality risks.