CVE-2026-7322

Memory safety bugs were discovered in Thunderbird ESR 140.10.0 and 150.0.0, exhibiting evidence of memory corruption that could be leveraged to execute arbitrary code. The flaws align with CWE‑119 (Buffer Overflow), CWE‑416 (Use‑After‑Free), and CWE‑787 (Out‑of‑Bounds Write), which can corrupt program memory and allow an attacker to influence control flow. Based on the description, it is inferred that the vulnerability can be triggered by malicious content such as crafted email attachments or messages, and may require user interaction or trust in the affected client to execute.

The documented affected releases are Mozilla Thunderbird ESR 140.10.0 and 150.0.0. In addition, the patches applied to Firefox 150.0.1, ESR 140.10.1, and ESR 115.35.1 suggest that earlier Firefox 150.0.0, ESR 140.10.0, and ESR 115.35.0 were likely affected, although the baseline description does not explicitly list them.

The CVSS score of 7.3 indicates a high severity level, while the EPSS score of less than 1% and the absence from CISA KEV imply a low likelihood of current exploitation. The likely attack vector is the delivery of malicious content to a user of the affected client, potentially through phishing or unsolicited attachments, which would need user interaction to be executed. Successful exploitation would grant an attacker arbitrary code execution on the compromised system.