Thunderbird can query a configuration‑specified LDAP address‑book server for auto‑completion. If the server is malicious, it can send an arbitrarily large amount of data to the client. The client accepts this data without sufficient size checks, causing memory exhaustion and resulting in a denial‑of‑service condition for the user when the LDAP address‑book feature is active.

Mozilla Thunderbird installations running 152.0.0 or earlier in the 152.x series or earlier than 140.12.1 in the 140.x series are affected. The vulnerability is mitigated by applying the releases 152.0.1 and 140.12.1 or later.

The CVSS score is 5.3, indicating a moderate severity, and the EPSS score of < 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the victim must be able to connect to the LDAP server; once that condition is met, the client will crash as soon as the large response is received. Thus the risk is limited to a local denial‑of‑service for the user rather than data compromise.