A MIME parsing error can be triggered by certain malformed email bodies, causing Thunderbird to read uninitialized memory. Based on the description, it is inferred that the lack of proper initialization can lead to memory corruption or unpredictable program behavior, potentially resulting in data disclosure, denial of service, or, in the worst case, exploitation of memory corruption for code execution. This flaw falls under CWE-457 and CWE-824.

Mozilla Thunderbird is affected. Versions before the release of the available fix remain vulnerable. The vulnerability was addressed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2; any installation older than those releases is impacted.

The CVSS score is 9.1 and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the receipt of an email that contains a malicious MIME structure; an attacker can craft headers or body content to induce the faulty parser. Although the description does not confirm arbitrary code execution, uninitialized memory usage lowers the barrier for attackers skilled in exploiting memory corruption, resulting in a non‑negligible risk for exposed systems.